A recovery point objective (RPO) is the maximum amount of data a system can afford to lose after a disruption. It is usually measured in time: for example, an RPO of 15 minutes means the organization should be able to restore data to a point no older than 15 minutes before the incident. RPO matters because it sets the pace for backups, replication, and snapshot intervals.
In cyber security and resilience planning, RPO helps determine whether a system needs hourly backups, near-real-time replication, or geographically separated storage. During ransomware, corruption, or a site outage, the RPO defines how much recent work may be lost when services come back online. A well-chosen RPO makes recovery goals realistic and prevents false confidence in backup systems.