Two numbers per service, agreed by the business rather than assumed by engineering, tiered so that not everything is treated as critical.
- RPO — recovery point objective: how much data may be lost, measured in time.
- RTO — recovery time objective: how long until service is restored.
The shape
| Tier | Services | RPO | RTO | Mechanism | Tested | Annual cost |
|---|---|---|---|---|---|---|
| 0 — Critical | Payment authorisation, Order submit | 0 | 15 min | Active-active, 2 regions, synchronous replication | Monthly, automated | ₹4.1 cr |
| 1 — Essential | Order management, Inventory | 30 s | 2 h | Warm standby, async replication, scripted failover | Quarterly, live | ₹1.6 cr |
| 2 — Important | Reporting, Customer portal | 4 h | 12 h | Backup restore to secondary region | Half-yearly, tabletop | ₹0.4 cr |
| 3 — Deferrable | Batch analytics, Archive | 24 h | 72 h | Backup restore, best effort | Annually | ₹0.05 cr |
Dependencies note: Order submit is Tier 0 but reads entitlement from CRM, which is Tier 2. The effective RTO of Order submit is therefore 12 hours unless it degrades gracefully without CRM. That degradation is a design requirement, not a nice to have.
When you produce it
Before the deployment topology is fixed, because the tier determines the topology. Re-run it after every acquisition and whenever a regulator asks about operational resilience.
Who reads it
Executives, who sign the cost column. Operations, who run to it. Regulators and auditors, who in several sectors now require both the numbers and evidence of testing. Architects, who design each tier's mechanism.
What good looks like
- Cost is on the same page as the target. Without it, everything is Tier 0.
- Tested column has a date, not an intention. An untested RTO is an estimate.
- Dependency inversions are called out explicitly, as in the note above — they are the most common way a stated RTO turns out to be fiction.
- Tiers are few. Four is plenty; eight means nobody can remember them.
- RPO of zero is written only where replication is genuinely synchronous.
Common mistakes
- Everything is Tier 0 because nobody was shown the cost.
- A critical service depending on a non-critical one, unnoticed until the test.
- Confusing backup frequency with RPO. Hourly backups give an RPO of one hour only if the restore actually works, and it is the restore that is untested.
- Numbers with no test. The first real failover then discovers the DNS TTL is 24 hours.