When organizations decide to outsource a critical service, business continuity (BC) leaders must increase vigilance over third-party contractual obligations related to recovery. Recovery time objective (RTO), one of the most commonly-used terms in our profession, can take on dramatically different shades of meaning, depending on the broader context in which it is established. In fact the RTO of a plan, in the absence of additional information, is not particularly enlightening. Identifying the RTO for a “capability” (inclusive term for business function or technology application) rightfully holds a prominent place in the planning process. Other aspects require clarification, to understand RTO in its proper perspective. This article addresses key additional considerations which must be uncovered when evaluating outsourced RTO agreements.
What minimum planning radius (MPR) applies to the RTO? The MPR “defines the geographic size of an event” which an organization has decided that the plan must address. The MPR typically should encompass at least the loss of an entire production site, but an organization may choose to plan for an outage on a larger or smaller scale. The RTO must be achievable without relying on any resources within the span of the MPR to support the recovery process.
The extent of MPR affects RTO duration either positively or negatively, in proportion. As MPR increases, so also should RTO. If an organization decides to plan for a 50-mile impact radius, for example, it will have longer RTOs than it would if it was planned for a single production site outage. A relatively short RTO may be difficult to achieve if the MPR is long.
What event triggers the start of RTO? Opinions vary on this topic, but the two primary options are when the disruptive outage occurs or when the recovery effort begins. The latter option excludes the assessment phase of recovery and thus may be over-optimistic. “Assessment includes the activities which occur before or after an initiating event and lead to confirmation of the execution priorities, time line and responsibilities, and a decision regarding when to execute.”
What activity marks the attainment of RTO? RTO is incomplete until verification has occurred. “Verification includes steps taken by a function, system, or application owner to ensure everything is in readiness to proceed to live operations.” Verification responsibility is particularly significant for an outsourced capability, as it may be appropriate to retain in-house.
Is the recovery strategy constrained or unconstrained? In a constrained strategy, the RTO may have a lower likelihood of being achieved, or the recovered capability may not provide the same level of service as the production environment. Recovery strategy constraints may include staff, technology, or facilities and exist whenever the recovering organization must rely on staffing or facilities which it does not control in the recovery environment or on a technology recovery solution which does not equal that which is in the production environment. Constraints exist when the recovering team relies on human resources which are committed to support multiple teams at the same time, a technology solution in the recovery environment which provides less capacity than the production environment, or third-party recovery workspace which is subscribed to multiple clients. In an unconstrained recovery strategy, the recovering organization has no material dependencies which could jeopardize achievement of the RTO.
Is the outsourced capability geographically dispersed across multiple production environments? When all resources operate from the same production site, that site should be considered a single point of failure, and the RTO will then signify the expected time that the capability is unavailable after an outage. If the capability exists in more than one production site, other questions arise. If one site becomes unavailable, what is the residual capacity of the other site(s) to continue providing the product or service while impacted resources recover? Does the RTO for the same capability vary at different production sites? How much time is needed to transfer workload from the impacted site to non-affected sites? Does the loss of any production site temporarily render the capability unavailable?
Finally (and most importantly), how often will the capability’s RTO be validated under realistic exercise conditions and documentation of the results be provided to the parent organization? Regardless of how well the contract spells out the nuance of RTO, only exercise results can provide confidence of the achievability of outsourced capability RTOs.
Business continuity oversight of outsourced capabilities plays a crucial role in the overall risk management of those relationships. Establishing (and validating) a shared perspective regarding these capabilities’ RTOs is an essential component of that oversight.
Frank Lady (bcjfrank@gmail.com) is a senior vice president of business continuity at Bank of America and chairs the DRJ Editorial Advisory Board and its Glossary of Terms Committee.
