An RTO and RPO assessment is a review, system by system, of whether the recovery time objective and the recovery point objective in a disaster recovery plan rest on a business impact analysis. It also asks whether a measurement stands beside each number, and whether the access and dependencies behind it will hold on the day. This checklist gives 12 checks and a score per system.
Last reviewed 2026-11-02 by Manish Sharma.
This guide is for an IT manager, IT head or business-continuity owner at a firm of roughly 250 to 2,000 people in India or the GCC. It scores the numbers, not the plan document or the test day. The marks are a Signisys working method, not a standard. Three other Signisys articles cover the next questions. One explains what the terms mean and why recovery runs late. Another shows how to work the numbers out and improve them. A third compares backup with replication.
What an RTO and RPO Assessment Scores, and What It Leaves Out
The assessment scores the evidence behind two numbers for each system. First, the AWS Well-Architected Framework asks for a recovery time objective and a recovery point objective for each workload, based on technical considerations and business impact. The recovery time objective is the delay the business accepts before service returns. Its counterpart, the recovery point objective, is the span of recent data it accepts losing. Below, the table shows what sits inside the sheet and what sits outside.
| Part of a plan | Scored here? | Where it is scored |
|---|---|---|
| The targets and the evidence behind them | Yes | This sheet |
| The plan document: scope, owners, contacts, upkeep | No | A checklist for scoring a data recovery plan |
| The test day: before, during and after | No | A checklist for the day of a recovery test |
| The choice of backup or replication method | No | A separate Signisys article on backup versus replication |
The sheet scores one system per pass. The sample is the three systems that the impact notes rank highest. A timed test counts here only as one piece of evidence, in checks 5 to 8.
Business Impact Analysis: The Input to Every Target
A business impact analysis is where the impact behind a target is written down. The Ready.gov business impact analysis page, last updated 25 March 2026, says the analysis predicts the consequences of a disruption and gathers the information needed to develop recovery strategies. Managers who know how the work is done answer a questionnaire about what happens if their function stops. The report then ranks which business functions to restore first.
The same page says the point in time of a disruption can have a significant bearing on the loss. It gives a power outage as an example: a few minutes would be a minor inconvenience, while hours could result in significant business losses. So a usable impact row holds more than a system name, and check 2 draws on this point.
A usable row holds four things for this assessment:
- a named business process
- what stops when it stops
- what changes as the outage lengthens
- whether lost data can be recreated from another source, which is one of the AWS impact questions
In Signisys’ view, write impact in words about what stops, not in figures. For the line between continuity and recovery, read how continuity differs from disaster recovery.
Marking an RTO and RPO Assessment: Recorded, Recalled or Missing
Each check earns one of three marks.
First, a mark of Recorded means the answer exists as a dated record that someone outside the system’s team can open. Second, Recalled means people state the answer from memory, or a record exists but has no date or covers part of the system. Third, Missing means nothing exists, or nobody can say.
Four rules keep the marking steady:
- A number kept only in someone’s head scores Recalled at most.
- A check that does not apply scores N/A and comes off the maximum, so one N/A leaves 22 points.
- Someone who does not run the system picks the sample and marks it. Then the same three systems are re-scored each time.
- Finally, there is no target total and no band, because the sum is arithmetic, not a standard.
For example, check 7 on an order-entry application: the business accepts losing 30 minutes of recent data. Meanwhile, the newest usable copy, read from the system on the review day, is 3 hours old. The figure is dated and filed, so the check is Recorded as an answer, and the gap against the 30-minute target is written on the same sheet. This is an illustration, not a client.
Key Takeaway A number scores for the evidence under it and beside it. However, an unrecorded number scores Recalled, whatever the team believes.
Checks 1 to 4: Where Each Target Came From
This group tests the business impact analysis row behind each target. Also, each question tests your own evidence.
| Question | Where the answer lives | Scores Recorded |
|---|---|---|
| 1. Does the target trace to a named business process, not only to the system’s tier label? | The impact row for the process | When the row names the process and what stops |
| 2. Does the impact row say what changes as the outage lengthens, and which days or hours matter? | The same row, as a time profile in words | When at least two outage lengths are described and the busy periods are named |
| 3. Does the impact row say whether lost data can be recreated from another source? | The same row | When it names the source, or states that none exists |
| 4. Was the target set from the impact first, before anyone read it against what the set-up delivers? | A dated impact row and a dated target | When the dates show the row came first |
In Signisys’ view, a Missing on checks 1 to 4 makes every later mark for that system provisional. AWS lists arbitrary objectives among its anti-patterns, and a target with no impact row behind it is hard to tell from an arbitrary one.
Checks 5 to 8: What the Set-Up Delivered
Next, this group sets the measured result beside the number. The impact row says what the measurement must protect. However, the testing checklist scores a timed test, so here only the figure it gave is used.
| Question | Where the answer lives | Scores Recorded |
|---|---|---|
| 5. Is there a measured recovery time for this system that is dated after its last major change? | The figure’s date | When the figure’s date falls after the change |
| 6. Was the measured time taken on the data volume the system holds today, not on a sample or a small test copy? | The run record’s data size and the size held now | When both sizes are written and the run used the full volume |
| 7. Was the data-loss target set against the age of the newest usable copy, read from the system on a dated day, not from the backup schedule? | The target with the copy age beside it | When the copy age and the day it was read are both written and set against the target |
| 8. Does the measured time run from the interruption to users working again, not from the start of the restore? | The measured figure’s stated start and end points | When the figure says where it starts and where it ends |
For check 8, a separate Signisys article on why recovery runs late explains the stages in between.
Where there is no measured run, check 5 is Missing, and checks 6 and 8 follow it. So do not estimate a figure to fill the gap.
Checks 9 to 12: What Stands Behind the Number
Finally, this group asks whether the number holds for the incident it was set for and the systems around it.
| Question | Where the answer lives | Scores Recorded |
|---|---|---|
| 9. Does each system this one needs to start have its own recovery time, and is it no longer than this system’s target? | The dependency list, with a number per item | When each item has a number or a noted clash |
| 10. Does each figure name the incident it assumes (one system, one site or a whole region), with its own figure where the incident differs? | The target row with the incident named | When every target names its incident and any second figure carries a date |
| 11. Where a customer contract or supplier promise states a recovery number for this system, is it on the sheet next to the internal one? | The contract clause reference and the internal figure | When both appear and any difference is noted |
| 12. Does a gap close only through a new measurement, with the old and new figures kept? | The old and new figures with their dates | When the new figure is a measurement, not an edit of the target |
The testing checklist lists dependencies, so check 9 asks only about their numbers. AWS lists differing objectives by incident type as an impact question, and check 10 asks for the incident behind each figure. A separate article on calculation shows how to set those numbers and which levers close a gap.
Editing the target to match the measured time closes the gap on paper. Meanwhile, the risk stays where it was.
From Marks to a Ranked Gap List: What to Fix First
First, add the marks for one system and subtract 2 from the maximum for each N/A. Then read the rows before the total. A Missing on a business impact analysis row is the first gap to chase. The order is checks 1 to 4 first, then checks 5 to 8, then checks 9 to 12. Next, within a group, start with the system that the impact notes rank highest.
The run for one system has five steps.
The table, in turn, says what to ask next for each Missing.
| If this is Missing | Ask this next | Who answers |
|---|---|---|
| Checks 1 to 4 | Can we see the impact row for this process? | The business owner |
| Check 5 or 8 | Can we see a measured run for this system? | The technical owner |
| Check 9 | What is the recovery time of each system this one needs? | The technical owners |
| Check 11 | Which clause states the figure? | Whoever holds the contract |
Finally, put each open gap in front of its business owner, with the question from the table.
Key Takeaway Chase checks 1 to 4 first, then checks 5 to 8, then checks 9 to 12.
Limits of an RTO and RPO Assessment, and When to Ask for Help
The sheet scores evidence, not recovery. So a full score does not show that a recovery will meet its targets on the day. A timed restore shows that, as a guide to running the timed restore explains. For a plan that was never tested, read what goes wrong in untested recovery plans. However, this article names no Indian or GCC rule and gives no legal advice. Your auditor or your contract sets any requirement. The sheet does not replace a business impact analysis, but it checks that one stands behind each number.
Three topics sit elsewhere in the Signisys set: the terms, the calculation and the backup comparison. Also, for backup jobs, alerts and restore tests, read a checklist for scoring backups.
When to ask for help. First, the business will not release time for impact notes on a system it calls critical. Second, a customer contract or audit asks for the recovery figures with the file behind them, and the sheet shows Recalled or Missing on checks 5 to 8 with a date to meet. Third, the re-measured figures keep missing the target after changes, and the sheet cannot say which stage holds the time.
Signisys provides business continuity and disaster recovery solutions, as well as consulting and managed cloud services. Read this as a description of a Signisys service, not neutral advice. Our page on meeting recovery targets sets out the approach.
RTO and RPO Assessment FAQ
Can one RTO and RPO assessment cover every system at once?
What if a system has an RTO but no business impact analysis behind it?
Does an RTO and RPO assessment replace a restore test?
How do we score a system that a supplier runs for us?
When is a system due for another assessment?
Who fills in checks 1 to 4, IT or the business?
Security Insights, Delivered.
Practical, vendor-neutral analysis of threats, tools, and architecture decisions.