--- title: "DRP: When Every Minute Counts | SUMāTO" description: "Why recovery time is money: how to define RTO/RPO by criticality and the role of hot recovery. By Andrés Lozada, SUMāTO." image: https://sumatogroup.com/hubfs/BRANDING/SUM%C4%81TO%20%7C%20LOGO%201000x500.png --- [Skip to content](https://sumatogroup.com/en/insights/blog/drp-cada-minuto-cuenta#main-content) - [INSIGHTS](https://sumatogroup.com/en/insights) - [SUPPORT](https://sumatogroup.com/en/support) - [CONTACT](https://sumatogroup.com/en/contact) EN [Español](https://sumatogroup.com/insights/blog/drp-cada-minuto-cuenta) [English](https://sumatogroup.com/en/insights/blog/drp-cada-minuto-cuenta) [![SUMāTO Group — home](https://sumatogroup.com/hs-fs/hubfs/BRANDING/SMT%20-%20LOGO.png?width=40&height=40&name=SMT%20-%20LOGO.png)](https://sumatogroup.com/en) - [HOME](https://sumatogroup.com/en/) - About #### SUMāTO - [About us→](https://sumatogroup.com/en/about-us) - [Terms→](https://sumatogroup.com/en/legal) - [Legal→](https://sumatogroup.com/en/legal) - [Cookies→](https://sumatogroup.com/en/legal) - [Data protection→](https://sumatogroup.com/en/legal) #### METHODOLOGIES - [Design Thinking→](https://sumatogroup.com/en/methodologies#design-thinking) - [Lean Startup→](https://sumatogroup.com/en/methodologies#lean-startup) - [PMI→](https://sumatogroup.com/en/methodologies#pmi) - [Scrum→](https://sumatogroup.com/en/methodologies#scrum) #### Vendors - [AWS→](https://sumatogroup.com/en/vendors#aws) - [Cisco→](https://sumatogroup.com/en/vendors#cisco) - [Dahua→](https://sumatogroup.com/en/vendors#dahua) - [Fortinet→](https://sumatogroup.com/en/vendors#fortinet) - [Huawei→](https://sumatogroup.com/en/vendors#huawei) - [Microsoft→](https://sumatogroup.com/en/vendors#microsoft) - [OCI→](https://sumatogroup.com/en/vendors#oci) - [Panduit→](https://sumatogroup.com/en/vendors#panduit) - Capabilities #### TECHNOLOGY - [Artificial Intelligence→](https://sumatogroup.com/en/artificial-intelligence) - [Data Analytics→](https://sumatogroup.com/en/data-analytics) - [Automation→](https://sumatogroup.com/en/automation-rpa) - [Cybersecurity→](https://sumatogroup.com/en/cybersecurity) - [Cloud→](https://sumatogroup.com/en/cloud) #### SEGMENTS - [SMB→](https://sumatogroup.com/en/smb) - [Enterprise→](https://sumatogroup.com/en/enterprise) - [Government→](https://sumatogroup.com/en/government) - Consulting #### Assessments - [AI Readiness→](https://sumatogroup.com/en/ai-readiness-assessment) - [Analytics→](https://sumatogroup.com/en/data-analytics-maturity-assessment) - [Cloud→](https://sumatogroup.com/en/cloud-readiness-assessment) - [Cybersecurity→](https://sumatogroup.com/en/cybersecurity-assessment) - [Enterprise Architecture→](https://sumatogroup.com/en/enterprise-architecture-assessment) - [IT Maturity→](https://sumatogroup.com/en/it-maturity-assessment) - [IT Strategy→](https://sumatogroup.com/en/technology-strategy-assessment) - [Process Automation→](https://sumatogroup.com/en/process-automation-assessment) #### Consulting & Architecture - [AI First→](https://sumatogroup.com/en/ai-first) - [BCP→](https://sumatogroup.com/en/business-continuity-plan) - [DRP→](https://sumatogroup.com/en/disaster-recovery-plan) - [Enterprise Architecture→](https://sumatogroup.com/en/enterprise-architecture-togaf) - [Enterprise Transformation→](https://sumatogroup.com/en/enterprise-transformation) - [IT Strategic Plan→](https://sumatogroup.com/en/it-strategic-plan) - [Strategic Consulting→](https://sumatogroup.com/en/strategic-consulting) - Operations #### INFRASTRUCTURE - [Data Center→](https://sumatogroup.com/en/data-center) - [Managed Services→](https://sumatogroup.com/en/managed-services) - [VDI→](https://sumatogroup.com/en/vdi) - [Intelligent Video Surveillance→](https://sumatogroup.com/en/video-surveillance) #### SECURITY - [NOC→](https://sumatogroup.com/en/noc) - [SOC→](https://sumatogroup.com/en/soc) #### USERS - [Modern Desktop→](https://sumatogroup.com/en/modern-desktop) - [Help Desk→](https://sumatogroup.com/en/help-desk) - Industries Industries - [Banking & Finance→](https://sumatogroup.com/en/banking-finance) - [Insurance→](https://sumatogroup.com/en/insurance) - [Government→](https://sumatogroup.com/en/government) - [Healthcare→](https://sumatogroup.com/en/healthcare) - [Telecommunications→](https://sumatogroup.com/en/telecommunications) - [Retail & Consumer→](https://sumatogroup.com/en/retail) - [Manufacturing→](https://sumatogroup.com/en/manufacturing) - [Energy, Oil & Gas→](https://sumatogroup.com/en/energy-oil-gas) - [Education→](https://sumatogroup.com/en/education) - [Logistics & Transportation→](https://sumatogroup.com/en/logistics-transport) - [Legal Services→](https://sumatogroup.com/en/legal-services) - [Engineering & Construction→](https://sumatogroup.com/en/engineering-construction) - Resources #### CONTENT - [Blog→](https://sumatogroup.com/en/insights) - [Use cases→](https://sumatogroup.com/en/use-cases) #### EVENTS - [Webinars→](https://sumatogroup.com/en/webinars) EN [Español](https://sumatogroup.com/insights/blog/drp-cada-minuto-cuenta) [English](https://sumatogroup.com/en/insights/blog/drp-cada-minuto-cuenta) Search - There are no suggestions because the search field is empty. [Continuidad y Resiliencia](https://sumatogroup.com/en/insights/tag/continuidad-y-resiliencia) # DRP: When Every Minute Counts [Andrés Lozada](https://sumatogroup.com/en/insights/author/andres-lozada) · Nov 19, 2019, 7:00:00 AM · 7 min read It is 3:14 in the morning and the billing system has stopped responding. The clock is ticking, orders are piling up and every minute that passes has a price: sales that don't close, customers who cannot operate, teams paralyzed while they wait for something to come back online. The question that defines an organization in that moment is not *whether* the failure happened, but **how long it takes to recover** and how much information was lost along the way. That is the underlying conversation in any disaster recovery plan. **In short:** recovery time is money. A serious disaster recovery plan (DRP) is not measured by the number of pages it has, but by two numbers agreed with the business: the RTO (how long a service can be down) and the RPO (how much information can be lost). Defining those numbers by criticality, and backing them with replication and hot recovery, is what separates a scare from a crisis. ## Why recovery time is money When a critical service goes down, the cost is not linear: it grows with every hour. There are visible costs, such as unbilled sales or contractual penalties, and silent costs that weigh more over the long term: eroded trust, teams reassigned to firefighting and decisions made blindly because the data is not available. The frequent mistake is treating all systems the same. Not everything needs to come back in minutes, but some services cannot wait hours. That is why the first discipline of a DRP is to **put a value on time**: what does an hour of downtime cost for this particular service? That answer, even if approximate, brings order to everything else. ## RTO and RPO: the two clocks that matter There are two metrics worth setting before buying technology or designing architectures. They are the backbone of any [disaster recovery](https://sumatogroup.com/drp) strategy: - **RTO (Recovery Time Objective):** the maximum time a service can remain unavailable before the impact becomes unacceptable. It answers the question "how long can I be down?". - **RPO (Recovery Point Objective):** the maximum amount of information the business is willing to lose, measured in time. It answers "how far back in time can I recover the data?". An RPO of five minutes means that, in the worst case, five minutes of transactions are lost. The key is that both numbers are defined by the **business, not by technology**. The technical area designs the solution to meet them; the process owner decides how much time and how much data are tolerable. When that conversation does not happen, the organization discovers its real RTO and RPO on the day of the incident, and they are almost always worse than imagined. ## How to define RTO and RPO by criticality This is not about demanding "zero downtime and zero loss" for everything, because that is expensive and, in most cases, unnecessary. It is about calibrating. A practical way to do it: - **Map the business processes**, not just the servers. Billing, dispatching, serving the customer, running payroll. - **Estimate the impact per unit of time** for each process that is halted. You do not need accounting precision; you need an order of magnitude to prioritize. - **Assign an RTO and RPO to each process** based on that impact, and only then drop down to the level of the systems that support it. - **Validate with whoever suffers the outage.** The operational owner usually has a sharper intuition than any spreadsheet. This exercise is, in reality, an extension of the business impact analysis that lives within a [business continuity plan](https://sumatogroup.com/bcp). The DRP is the technological leg of that continuity: it translates the priorities of the business into measurable recovery objectives. ## Classifying services by tiers With the RTOs and RPOs defined, it is wise to group services into tiers. This avoids overspending on what does not warrant it and underspending on what does. A reference scheme, which each organization adjusts to its reality: - **Critical tier:** services whose failure halts the operation or exposes contractual obligations. Very low RTO and RPO. They justify replication and hot recovery. - **Important tier:** services the business needs the same day, but which tolerate a few hours of interruption. Moderate RTO and RPO, with frequent backups and agile procedures. - **Deferrable tier:** supporting services whose recovery can wait one or more days without material harm. Standard backups and on-demand recovery. The value of this classification is that it turns an emotional discussion ("everything is urgent!") into a reasoned investment decision. Each tier has an associated cost and architecture, and the business can see what it is paying for every minute it saves. ## The role of replication and hot recovery For critical-tier services, traditional backups rarely suffice: restoring from a copy can take hours the RTO does not allow, and last night's copy may violate an RPO of minutes. This is where two capabilities come in: - **Replication:** keeping a copy of the data updating continuously or almost continuously at another site. The closer to real time, the lower the RPO. It is the difference between losing a day of data and losing seconds. - **Hot recovery:** having infrastructure already powered on and ready to take the load when the primary site fails. It drastically reduces the RTO because there is no need to provision or start from scratch; the service fails over. These capabilities cost more, which is why they are reserved for what truly needs them. The smart decision is not to "replicate everything" but to align each service's level of protection with the RTO and RPO the business has agreed to pay for. A mature DRP is, at its core, an honest negotiation between the cost of time and the cost of prevention. ## From document to real capability One point worth remembering in these year-end months, when budgets are being planned: a DRP is not a deliverable to be filed away. It is a capability that must be kept alive. The RTOs and RPOs defined today must be revisited when the business changes, when systems are added or when an acquisition alters the process map. The number that was tolerable last year may be ruinous today. ## Frequently asked questions ### What is the difference between RTO and RPO? The RTO measures downtime: how long a service can be down. The RPO measures data loss: how far back in time you can recover the information. A service can have a high RTO and a low RPO, or vice versa, depending on what the business tolerates. ### Does a DRP replace backups? No. Backups are one piece within the DRP. For deferrable services they may be enough; for critical services you also need replication and hot recovery, because restoring from a copy usually takes longer than the RTO allows. ### How do I know which services are truly critical? By starting from the business, not from technology. Map the processes, estimate the cost of having them halted per unit of time and let that impact define criticality. A server that is important to IT may support a deferrable process, and the other way around. ### Wouldn't replicating everything be the safest option? It would be the most expensive, and not necessarily the most sensible. Protection should be proportional to impact. Replication and hot recovery are justified where every minute costs; for the rest, they make the operation more expensive without a clear return. ## The first step If your organization still does not have an RTO and RPO agreed in writing for its critical services, that is the place to start: a conversation between the business and technology that puts a number on the cost of time. At **SUMāTO** we support that exercise, from classifying services into tiers to designing the replication and hot recovery each tier requires. [Let's talk](https://sumatogroup.com/contacto) about how to ensure that, the next time the clock starts ticking, you know exactly how long you can wait and how much you can afford to lose. Continue reading - [Operational Resilience: DR as a Service (DRaaS)](https://sumatogroup.com/en/insights/blog/draas-resiliencia) - [Ransomware Recovery: Backups That Actually Work](https://sumatogroup.com/en/insights/blog/recuperacion-ante-ransomware) Next step How much can your operation lose before it recovers? Measure it before the incident. [Cybersecurity Assessment →](https://sumatogroup.com/en/cybersecurity-assessment) [Continuidad y Resiliencia](https://sumatogroup.com/en/insights/tag/continuidad-y-resiliencia) ![Andrés Lozada](https://sumatogroup.com/hs-fs/hubfs/SPEAKERS/AL.jpeg?width=56&height=56&name=AL.jpeg) Andrés Lozada Nov 19, 2019, 7:00:00 AM [LinkedIn](https://www.linkedin.com/in/andreslozada/) ### Explore more from SUMāTO [Enterprise AI](https://sumatogroup.com/en/artificial-intelligence) [Enterprise Transformation](https://sumatogroup.com/en/enterprise-transformation) [Strategic Consulting](https://sumatogroup.com/en/strategic-consulting) [AI Agent](https://sumatogroup.com/en/artificial-intelligence) [AI Contact Center](https://sumatogroup.com/en/artificial-intelligence) [Cybersecurity](https://sumatogroup.com/en/cybersecurity) ### Related Posts #### [Operational Resilience: Lessons from the July Outage](https://sumatogroup.com/en/insights/blog/resiliencia-operativa-leccion) In the early hours of July 19, 2024, millions of screens across airports, hospitals, banks and data centers turned blue. A single faulty update was... #### [Ransomware Against Critical Infrastructure: The Lesson of a Halted Pipeline](https://sumatogroup.com/en/insights/blog/ransomware-infraestructura-critica) On May 7, 2021, one of the most significant fuel pipelines in North America shut down its operation. It was not a mechanical failure or a physical... #### [Cyber resilience with AI: defend and recover from ransomware](https://sumatogroup.com/en/insights/blog/ciber-resiliencia-ia) The ransomware of 2026 no longer looks like that of three years ago. Where an attacker once needed days or weeks to move inside a network, [artificial...](https://sumatogroup.com/en/artificial-intelligence) ![SUMāTO](https://sumatogroup.com/hs-fs/hubfs/BRANDING/SUM%C4%81TO%20%7C%20LOGO%201000x500.png?width=200&height=100&name=SUM%C4%81TO%20%7C%20LOGO%201000x500.png) Strategic technology planning consultants. AI, Analytics, Cloud and Cybersecurity ## Navigation [Home](https://sumatogroup.com/en) [Capabilities](https://sumatogroup.com/en/artificial-intelligence) [Consulting](https://sumatogroup.com/en/strategic-consulting) [Operations](https://sumatogroup.com/en/managed-services) [Industries](https://sumatogroup.com/en/banking-finance) [Resources](https://sumatogroup.com/en/insights) ## SUMāTO [About](https://sumatogroup.com/en/about-us) [Terms](https://sumatogroup.com/en/legal#terminos) [Legal & Privacy](https://sumatogroup.com/en/legal) [Data protection](https://sumatogroup.com/en/legal) Cookies ## [Contact](https://sumatogroup.com/en/contact) [sales@sumatogroup.com](mailto:sales@sumatogroup.com) Mexico HQ Mexico City, Mexico [+52 55 8897 5791](tel:+525588975791) Bogotá Bogotá, Colombia [+57 601 724 5059](tel:+576017245059) © 2026 SUMāTO Group. All rights reserved. ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Andrés Lozada", "url" : "https://sumatogroup.com/en/insights/author/andres-lozada" }, "dateModified" : "2026-07-09T19:23:39.477Z", "datePublished" : "2019-11-19T13:00:00.000Z", "headline" : "DRP: When Every Minute Counts | SUMāTO", "mainEntityOfPage" : { "@id" : "https://sumatogroup.com/en/insights/blog/drp-cada-minuto-cuenta", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://sumatogroup.com/hubfs/BRANDING/Logo_SUMATO_Original%20-%201000x500.png" }, "name" : "SUMāTO Group" } } ``` ```json { "@context" : "https://schema.org", "@type" : "FAQPage", "mainEntity" : [ { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "The RTO measures downtime: how long a service can be down. The RPO measures data loss: how far back in time you can recover the information. A service can have a high RTO and a low RPO, or vice versa, depending on what the business tolerates." }, "name" : "What is the difference between RTO and RPO?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "No. Backups are one piece within the DRP. For deferrable services they may be enough; for critical services you also need replication and hot recovery, because restoring from a copy usually takes longer than the RTO allows." }, "name" : "Does a DRP replace backups?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "By starting from the business, not from technology. Map the processes, estimate the cost of having them halted per unit of time and let that impact define criticality. A server that is important to IT may support a deferrable process, and the other way around." }, "name" : "How do I know which services are truly critical?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "It would be the most expensive, and not necessarily the most sensible. Protection should be proportional to impact. Replication and hot recovery are justified where every minute costs; for the rest, they make the operation more expensive without a clear return." }, "name" : "Wouldn't replicating everything be the safest option?" } ] } ``` ```json { "@context" : "https://schema.org", "@id" : "https://sumatogroup.com/#organization", "@type" : "Organization", "address" : { "@type" : "PostalAddress", "addressCountry" : "MX", "addressLocality" : "Huixquilucan", "addressRegion" : "Estado de México", "postalCode" : "52787", "streetAddress" : "Av. Vialidad de la Barranca No. 6, Torre 1, Suite 400, Piso 4, Col. Bosques de las Palmas" }, "alternateName" : [ "SUMāTO Group", "SUMATO Group", "Sumato Group", "SUMATO", "SUMaTO", "SUMaTO Group", "SUMTO", "SUMTO Group" ], "areaServed" : [ { "@type" : "Country", "name" : "México" }, { "@type" : "Country", "name" : "Colombia" }, { "@type" : "Place", "name" : "Latinoamérica" } ], "contactPoint" : { "@type" : "ContactPoint", "areaServed" : "Latinoamérica", "availableLanguage" : [ "es", "en" ], "contactType" : "sales", "email" : "sales@sumatogroup.com" }, "description" : "SUMāTO is a Latin American technology consulting and integration firm founded in 2016, with a presence in Mexico and Colombia. It designs, implements and operates artificial intelligence, data analytics, automation, cybersecurity and cloud on the systems a client already runs, under governance frameworks such as NIST AI RMF and ISO/IEC 42001.", "foundingDate" : "2016", "knowsAbout" : [ "Inteligencia Artificial", "IA Generativa", "Agentes de IA", "Analítica de Datos", "Big Data", "Automatización de Procesos (RPA)", "Ciberseguridad", "Computación en la Nube", "Continuidad del Negocio y Recuperación ante Desastres", "Arquitectura Empresarial", "Transformación Digital" ], "legalName" : "SUMāTO Group", "location" : [ { "@type" : "Place", "address" : { "@type" : "PostalAddress", "addressCountry" : "MX", "addressLocality" : "Huixquilucan", "addressRegion" : "Estado de México", "postalCode" : "52787", "streetAddress" : "Av. Vialidad de la Barranca No. 6, Torre 1, Suite 400, Piso 4, Col. Bosques de las Palmas" }, "name" : "SUMāTO MX", "telephone" : "+52 55 8897 5791" }, { "@type" : "Place", "address" : { "@type" : "PostalAddress", "addressCountry" : "CO", "addressLocality" : "Bogotá", "streetAddress" : "Cra. 45 # 103-34, Of. 202" }, "name" : "SUMāTO CO", "telephone" : "+57 601 724 5059" } ], "logo" : { "@type" : "ImageObject", "height" : 500, "url" : "https://sumatogroup.com/hubfs/BRANDING/SUM%C4%81TO%20%7C%20LOGO%201000x500.png", "width" : 1000 }, "name" : "SUMāTO", "sameAs" : [ "https://www.linkedin.com/company/sumatogroup", "https://www.youtube.com/@sumatogroup", "https://torre.ai/teams/SUMaTOGroup", "https://www.cbinsights.com/company/sumto-group", "https://elioplus.com/profiles/channel-partners/57295/sumato-group" ], "telephone" : "+52 55 8897 5791", "url" : "https://sumatogroup.com" } ``` ```json { "@context" : "https://schema.org", "@id" : "https://sumatogroup.com/#website", "@type" : "WebSite", "description" : "Technology consulting in AI, data, automation, cybersecurity and cloud across Latin America.", "inLanguage" : "en", "name" : "SUMāTO", "publisher" : { "@id" : "https://sumatogroup.com/#organization" }, "url" : "https://sumatogroup.com" } ``` ```json { "@context" : "https://schema.org", "@type" : "BreadcrumbList", "itemListElement" : [ { "@type" : "ListItem", "item" : "https://sumatogroup.com/en", "name" : "Home", "position" : 1 }, { "@type" : "ListItem", "item" : "https://sumatogroup.com/en/insights/blog/drp-cada-minuto-cuenta", "name" : "DRP: When Every Minute Counts", "position" : 2 } ] } ```