This week, I learned why certain people shouldn't write security policies involving maths.
In particular, if you're writing policies (or defining service levels) in terms of RTO and availability percentages, don't forget that an availability percentage only makes sense relative to a reporting interval. "I want 99.95% availability" means nothing on its own. If that's an average you need to meet across an entire year, 1 outage of 4 hours is just as acceptable as 10 outages of 26 minutes. But if that's the level you have to meet each month, you'll have missed your mark when a single outage lasts more than 23 minutes.
The RTO doesn't make sense if it exceeds the maximum accepted time of unavailability in the reporting interval. In fact, it should only be a fraction of it, because the RTO is your objective for each individual incident. This means you'd also have to model how many incidents you expect to have during your reporting interval, and how long they will take to resolve, and it's actually worth a whole study on your history of incidents and how they materially affected business operations, and (if you're on the demand side) what you would've liked to have happened instead.
Except that none of this matters when you live in a world where maths don't exist. The policy I read coupled a 99.99% availability to an RTO of 24 hours. That would only start make sense for a reporting interval of at least 1000 days.
