Fictional example. A portal accepts applications. It stores metadata in a database, attachments in object storage and sends a queue message after submission. The team declares an RPO of five minutes and an RTO of 30 minutes. Database backups run every five minutes, but files have a separate schedule. Nobody has rehearsed full recovery. After a regional outage the operator restores the database; the portal starts, but some attachments are missing and the processing state of some applications is uncertain.
The business owner asks whether traffic can resume. The 30-minute target runs from outage detection to restoration of the user journey, not merely database startup.
What must be restored and checked before you resume submissions? How will you verify a five-minute RPO and 30-minute RTO for the whole service?
Guiding questions
- Does the database RPO also cover attachments and the queue?
- When is the service restored: at database startup or after a user-journey test?
- What happened to messages published just before the outage?
- How will you measure data loss and elapsed time since detection?