Turn downtime and data-loss concerns into recovery objectives that service owners and technical teams can assess together.
Name the service before choosing a number
Start with a business activity such as order processing, appointment booking or payroll. Identify the people who depend on it and the consequences of interruption. A server name alone does not explain the business impact. Keep the first conversation focused on one service so the assumptions and trade-offs remain visible.
Separate downtime from data loss
Recovery time objective concerns the target time to restore an agreed service. Recovery point objective concerns the target limit on data loss, usually expressed as time. They are related but different. Faster backup frequency does not necessarily make an application quicker to restore, and a rapid restart does not guarantee that the latest transactions are present.
Discuss workarounds and minimum service
Ask what the team can do while the system is unavailable. A temporary manual process may support essential work, but it can introduce limits, errors or a backlog. Define the minimum useful service and the point at which the workaround stops being acceptable. Include the effort needed to reconcile work once the normal service returns.
Identify what the target depends on
Restoration may require identity systems, network services, application components, keys, licences and provider support. Record those dependencies and who owns them. A target that ignores access to the backup console or the time needed to obtain replacement capacity can create false confidence. Include the whole process in the discussion.
Compare the objective with evidence
Review measured restoration results and explain what each test covered. A file recovery does not demonstrate that a complete business service can meet its target. If the objective and evidence differ, make the gap explicit. The decision may involve improved capability, a better workaround, additional testing or revised expectations.
Revisit objectives when the business changes
New applications, acquisitions, seasonal demand and changes in suppliers can alter the impact of an outage. Assign ownership and review the objectives when those changes occur. Keep the technical plan and the business expectation together so the organisation does not continue relying on a target that no longer reflects how it works.
Further reading: CISA #StopRansomware Guide.