Your expert in backup and data protection!The solution tailored to your needs
DRP and BCP
How do you determine your RPO?
You determine an RPO by asking, for each activity: “if we lost everything entered over the last X hours, what would have to be redone, and what would it cost?” The largest value of X that is still acceptable is the RPO. You then configure the backup so that the interval between two successful copies is shorter than this X.
Key points
- Ask the question to the users of each tool, not just to the IT person.
- Three criteria: how fast the data changes, whether it can be rebuilt, and the cost of losing it.
- An RPO of 24 hours assumes a morning alert: two failures in a row, and the actual RPO becomes 48 hours.
- Below one hour, plan for replication or database logs, and a history to protect against ransomware.
- The depth of history (30 days, one year) is a setting separate from the RPO.
The method in a single meeting
NIST, the US standards body, calls this exercise a business impact analysis (BIA): identifying processes, measuring the consequences of an interruption, then setting recovery priorities. For an SME, one meeting is enough. For each vital tool, ask three questions to the people who use it, not just to the IT person.
- How fast does the data change? One write per minute, per hour, per week?
- Can it be rebuilt? An email received from outside, no. An invoice whose copy is still on the customer’s desk, partly. A record of workshop production, no.
- After how much lost time does the cost become unacceptable? Cost of re-entry, orders to be placed again, files to be reopened from memory.
Write the answer down in hours. Common examples in SMEs:
| Activity | Often reasonable RPO | Why |
|---|---|---|
| Rarely modified office files | 24 h | The loss of a day is noticed and can be redone |
| ERP or quoting software used throughout the day | 1 to 4 h | A lost day of quotes cannot be reconstructed |
| 1 to 8 h | Incoming messages cannot be re-entered | |
| Accounting | 24 h, plus separate long-term archiving | A day can be redone; the financial year, for its part, is archived |
| Point-of-sale database | Minutes to 1 h | Cash received must remain traceable |
This table is not a standard. It is a starting point to challenge or confirm with operational staff.
Translating the RPO into a frequency
- RPO 24 h: one successful backup per day, and a morning alert if it failed. If it fails two nights in a row, the actual RPO becomes 48 h. Monitoring is part of the RPO.
- RPO 4 h: at least one copy every four hours during business hours.
- RPO under one hour: replication or very frequent copies, and a separate discussion about ransomware, because the most recent copy may already be bad. ANSSI, France’s national cybersecurity agency, also recommends considering replication in addition to backup when the tolerable loss is under 24 hours.
For a database, the frequency is not set by full backups alone. Microsoft states that in the full recovery model, frequent transaction log backups make it possible to restore to a specific point in time. This is often the most cost-effective way to achieve an RPO of a few minutes on business software.
Also plan for depth: being able to go back 30 days does not change the RPO (which is about freshness), but it saves you when the latest copies are corrupted. ANSSI cites, for example, 15 days of daily backups, one year of monthly backups and five years of annual backups. The two settings coexist.
Checking that the RPO holds
An RPO is checked in the console, not in the contract:
- the time of the last successful copy of each server, every morning;
- the duration of the jobs: a backup that takes five hours cannot run every four hours;
- the volume of changes sent compared with the site’s upload bandwidth;
- a restore test, at least on one file, to prove that the copy is readable. See How do you test that a backup works?.
Mistakes
- Letting the software vendor announce the RPO (“real-time backup”) without looking at the actual interval between jobs.
- A single RPO for the whole company, based on the most active application, which means paying for the maximum level for static files.
- Forgetting that the RPO of cloud email is that of your copy, not that of the vendor’s recycle bin.
At WeDoBack
The frequency is set in the console: the RPO depends on this choice by the customer. The subscribed volume must be able to absorb this frequency, because more closely spaced copies retain more changes. The published rule of thumb for getting started is the current volume multiplied by three, to be adjusted after a week of use. WeDoBack does not impose an RPO. If the customer’s connection cannot send the changes within the chosen interval, the actual RPO will be longer than the displayed RPO: this is a physical constraint, to be measured in the first month, not a detail. Backup monitoring runs 24/7; human support is available from 9 am to 1 pm and from 2 pm to 5:30 pm (Paris time). Prices for the SMART and INTEGRAL offers are detailed on the offers and prices page.
Frequently asked questions
Who should set the RPO, management or IT?
Management and business managers, because the RPO is an economic choice: how much lost work the company accepts. IT then translates this choice into a backup frequency and flags what is technically impossible with the available bandwidth or budget.
Should all servers have the same RPO?
No. A single RPO, based on the most active application, means paying for the maximum level for files that rarely change. One line per activity, with its own frequency, is more accurate and often cheaper.
Is the RPO for Microsoft 365 or Google Workspace the vendor’s?
No. The vendor’s recycle bins and retention are not a copy under your control. The RPO of your email is that of your own backup: its frequency and its last successful run.
Further reading
Sources
Documents consulted in October 2026.
Planning a backup, DRP or BCP project?
More than 20 years of experience protecting business data.
Request a quote+33 9 72 50 78 28Protect your data with WeDoBack
Encrypted offsite backup, immutable storage, DRP and BCP: tell us about your servers and we will recommend the right combination.