Last reviewed: October 27, 2026 · Reading time: 9 minutes
Every disaster recovery plan rests on two numbers. The recovery time objective (RTO) is how long a system can be down before the damage becomes unacceptable. The recovery point objective (RPO) is how much data, measured in time, you can afford to lose. Get them right and you spend money where it matters. Get them wrong and you either overpay to protect systems nobody misses for a day, or discover mid-outage that your most important system can’t come back for a week.
- In ITIC’s 2024 survey of more than 1,000 firms, over 90% of mid-size and large enterprises said one hour of downtime costs them more than $300,000.
- Uptime Institute found 54% of organizations’ most recent significant outage cost over $100,000, and 20% cost over $1 million.
- RTO and RPO should be set per system, based on what an hour of that system’s downtime costs, not as one number for the whole business.
- A target is only real once you have measured it in a test restore.
What downtime really costs
Small firms work with smaller numbers, but the same logic. ITIC gives two simple SMB examples: if an hour of downtime costs you $10,000, that is about $167 per server per minute; at $25,000 an hour it is about $417 per server per minute (ITIC 2024).
Outages are also not only about cyberattacks. Uptime Institute’s 2025 analysis attributes 54% of impactful outages to power problems and says human error plays a part in roughly two-thirds to three-quarters of all outages (Data Center Knowledge, May 2025). For a New York office, that includes building power work, summer storms and the occasional mistaken deletion.
How to calculate your own hourly cost
For each important system, estimate:
- Lost revenue per hour if the system is down (billable hours that can’t be worked, orders that can’t be taken).
- Idle labour per hour: number of people who can’t work × loaded hourly cost.
- Recovery and overtime costs after the outage.
- Penalties and contractual exposure: missed court or regulatory deadlines, SLA credits.
- Reputational cost: harder to price, but real for client-facing firms.
Add the first four to get a working hourly figure. That number tells you how much it is worth spending to shorten the outage.
A worked example: a 40-person New York accounting firm
The figures below are illustrative, not client data, but they reflect the kind of tiering we build with clients.
| Tier | System | Estimated cost per hour down | Target RTO | Target RPO | Typical approach |
|---|---|---|---|---|---|
| Tier 1 | Microsoft 365 email and files | $6,000 | 4 hours | 1 hour | Third-party Microsoft 365 backup with frequent snapshots and granular restore |
| Tier 1 | Practice management and tax software server | $5,000 | 4 hours | 15 minutes | Continuous replication to the cloud (Azure Site Recovery or AWS Elastic Disaster Recovery) |
| Tier 2 | File archive of closed engagements | $500 | 48 hours | 24 hours | Nightly immutable backup |
| Tier 3 | Intranet and internal wiki | $100 | 5 days | 24 hours | Nightly backup, restore on demand |
The Tier 1 systems justify continuous replication because shaving even a few hours off an outage pays for the service many times over. Tier 3 doesn’t, so it gets simple, cheap nightly backups. This is the same tiering you will need for the recovery time field now required in many regulatory asset inventories, including NYDFS Part 500.
Choosing the technology to match the target
| Target | What usually achieves it |
|---|---|
| RPO of seconds to minutes, RTO under an hour | Continuous block-level replication to a cloud DR site with pre-built failover runbooks |
| RPO of 1 to 4 hours, RTO of a few hours | Frequent snapshots or incremental backups with tested restore procedures |
| RPO of 24 hours, RTO of a day or more | Nightly backups to immutable cloud storage |
Whatever the technology, at least one copy should be immutable and isolated so ransomware can’t reach it, in line with the 3-2-1-1-0 rule. And remember that a fast restore of infected data is worse than useless; read why clean recovery matters more than speed alone.
Prove it: test against the target
RTO and RPO on paper are assumptions. Run a recovery test for each Tier 1 system at least quarterly, time it from the start of the incident to users working again, and record the result. If the measured time misses the target, either invest to close the gap or change the target and tell the business. Our article on the 24-hour recovery standard walks through a realistic test.
Know your real recovery time
Ron Klink can help you price your downtime, set RTO and RPO per system and design disaster recovery that meets them.
Sources
- ITIC, 2024 Hourly Cost of Downtime Survey, Part 2 (survey conducted November 2023 to March 2024).
- Data Center Knowledge, Data center outages decline for fourth straight year, but issues persist (Uptime Institute Annual Outage Analysis 2025), May 2025.
