RPO/RTO Gap Calculator

System or service:

Review one recovery target at a time.

Recovery tier:

{{ field.label }}:

Change rate:

Zero leaves change exposure unmodeled.

changes/hr

Downtime exposure:

Zero leaves monetary exposure unmodeled.

$/hr

Objective tolerance:

Zero keeps a strict objective check; use a buffer only when policy permits it.

Evidence source:

This source label stays with the evidence and action artifacts.

Evidence age:

Use zero when the evidence is current or its age is unknown.

days

Objective	Target	Measured	Position	Decision	Copy
{{ row.objective }}	{{ row.target }}	{{ row.measured }}	{{ row.position }}	{{ row.decision }}

Signal	Priority	Evidence	Next action	Copy
{{ row.signal }}	{{ row.priority }}	{{ row.evidence }}	{{ row.action }}

Planning sketch	RPO	RTO	Fit	Copy
{{ row.label }}	{{ row.rpo }}	{{ row.rto }}	{{ row.fit }}

A recovery objective becomes useful when current evidence can be compared with it. The scheduled backup interval, architecture diagram, or intended restore procedure does not prove recovery capability. A restore exercise, incident review, replication measurement, or other defensible record should show how much data would be lost and how long users would wait for a usable service.

Recovery Point Objective (RPO) limits the acceptable age of recovered data. Recovery Time Objective (RTO) limits the acceptable delay from disruption until the service is usable. They measure different consequences, so a strong RPO cannot compensate for a missed RTO and a fast restore cannot compensate for stale recovered data.

RPO and RTO evidence distinctions
Measure	What to measure	Common mistake
RPO	Worst credible age of the data available after recovery.	Using backup cadence without proving the recoverable point.
RTO	Elapsed time through restore, validation, cutover, and handoff.	Stopping the clock when files restore but the service is not usable.
Evidence freshness	Age and source of the latest representative recovery evidence.	Keeping a passing result after architecture, data volume, or dependencies change.

Business impact should set the objectives. Technical teams then choose and test a recovery strategy that can meet them. Very tight objectives can require continuous replication, pre-provisioned capacity, automation, and more cost; loose objectives can expose the organization to unacceptable data loss or downtime.

Optional exposure rates translate positive gaps into planning quantities. A change rate estimates how many additional records, transactions, or files fall inside an RPO miss. A downtime rate estimates monetary exposure inside an RTO miss. These values depend entirely on the entered rates and should not be presented as measured losses.

A gap comparison helps direct remediation, but it is not a recovery test. Preserve the evidence source, measurement definition, dependencies, scenario, and test date so a pass or miss can be reviewed later.

How to Use This Tool:

Review one system or service against one approved objective set and one comparable evidence set.

Enter the system or service name and choose its recovery tier. The tier labels the review but does not change the calculation.
Enter target and measured RPO in minutes, hours, or days. Use recovered-data age for the measured value, not merely the nominal backup interval.
Enter target and measured RTO with the same discipline. Include restoration, validation, cutover, dependencies, and operational handoff before stopping the measured clock.
Open Advanced for change rate, downtime exposure, objective tolerance, evidence source, and evidence age. Keep tolerance at 0 unless an approved policy explicitly permits a buffer.
Read the RPO and RTO positions separately, then use the recovery actions and improvement scenarios as planning prompts. Correct any rejected duration or rate before relying on the status.

Interpreting Results:

A positive signed gap is a miss. Zero or a negative value passes and the negative magnitude is reported as headroom. Combined positive gap adds only missed minutes, so headroom on one objective never hides a miss on the other.

RPO and RTO result boundaries
Status	Exact boundary	Meaning
Objectives met	RPO gap ≤ 0 and RTO gap ≤ 0	Both measured values fit inside their effective targets.
RPO or RTO gap	The corresponding gap > 0	That objective needs its own remediation.
Severe gap	Positive gap ≥ 100% of its effective target, or the effective target is 0	The measured value exceeds at least twice a nonzero target, or misses a zero target.
Evidence stale	No objective misses and evidence age > 90 days	A passing result needs fresher evidence.

RPO action cues point toward backup cadence, replication lag, snapshot delay, point-in-time recovery, and application consistency. RTO cues point toward restore automation, dependency order, validation, capacity readiness, cutover, and a warmer recovery pattern.

The improvement scenarios apply fixed illustrative factors to measured values. They show the scale of improvement that might close a gap; they do not predict what a particular technology or project will deliver.

Technical Details:

Every duration is converted to minutes before comparison. Objective tolerance expands both targets by the same entered percentage. The signed calculation is then performed independently for RPO and RTO.

Formula Core:

Let t be the approved target, m the measured duration, and q the permitted tolerance percentage.

\begin{array}{lcl} t_{effective} & = & t \times (1 + \frac{q}{100}) \\ gap & = & m - t_{effective} \\ positive gap & = & \max (0, gap) \\ change exposure & = & \frac{positive RPO gap in minutes}{60} \times changes per hour \\ downtime exposure & = & \frac{positive RTO gap in minutes}{60} \times USD per hour \end{array}

For target RPO 15 minutes and measured RPO 45 minutes with 0% tolerance, the signed gap is +30 minutes. Target RTO 60 minutes and measured RTO 90 minutes also gives +30 minutes. Both objectives miss, the combined positive gap is 60 minutes, and the RPO miss is severe because its 30-minute gap is at least 100% of the 15-minute target.

Rule Core:

Status selection follows the two independent miss flags. A severe flag takes precedence within an RPO-only, RTO-only, or dual miss. Evidence can become stale only when both objectives pass.

Illustrative recovery improvement scenario factors
Planning scenario	Measured RPO factor	Measured RTO factor
Current measured state	1.00	1.00
Backup cadence and replication tuned	0.50	0.95
Restore automation and validation shortened	0.90	0.65
Warmer recovery pattern	0.35	0.45
Effective objective boundary	Target	Target

Tolerance accepts 0% through 50%. Evidence age is rounded down to whole days. All duration and exposure inputs must be finite and nonnegative; invalid values withhold the computed result.

Accuracy Notes:

Use business-approved objectives and evidence from a representative failure and recovery path.
Keep RPO and RTO measurement definitions consistent across repeated reviews.
Include dependencies and validation in measured RTO; use actual recoverable data age for measured RPO.
Treat exposure rates and improvement scenarios as user-supplied planning assumptions.
Retest after material changes to architecture, data volume, dependencies, staffing, or recovery procedures.

References:

Contingency Planning Guide for Federal Information Systems, National Institute of Standards and Technology, May 2010.
REL13-BP01 Define recovery objectives for downtime and data loss, AWS Well-Architected Framework.
REL13-BP02 Use defined recovery strategies to meet the recovery objectives, AWS Well-Architected Framework.
Disaster recovery planning guide, Google Cloud Architecture Center, reviewed July 5, 2024.