How to Review Vendor RTO, RPO, and Disaster-Recovery Test Evidence

Niko, Ops at a 29-person UK fintech, is about to accept a vendor MSA — the umbrella contract that order forms sit under — because sales said the backup is commercially reasonable. Write two clocks, name the systems, refuse a 2019 tabletop as a 2026 result, then match, add a schedule, or walk.

September 2026. Finance signed off £6,200 a month on a payments-reconciliation SaaS under the customer-payment important business service. Clause 11.4: “Supplier shall maintain commercially reasonable backup and disaster-recovery arrangements.” No hours. No named production ledger, payout file, or identity store. AE Slack: “we have SOC 2.” They send November 2019 tabletop minutes. Niko’s last card-scheme miss burned a Friday of manual payouts. That outage was costly. Go-live is Monday.

Commercially reasonable backup is not an RTO, and a 2019 tabletop is older than the FCA operational-resilience transition. FCA rules came into force 31 March 2022; payment institutions and electronic money institutions had until 31 March 2025 to map and test inside impact tolerances. Niko is not a PRA bank. The firm still owns a third-party miss.

Disclaimer: Checkory provides AI support, not legal advice. Consult a qualified lawyer for binding decisions.

How do you split hours to restore from hours of data you can lose?

RTO is hours forward from the outage — how long the named service may stay down. RPO is hours back — the age of the backup you are allowed to land on. Write both blanks before anyone debates “backup.” A nightly job with a three-day restore is a 24-hour RPO story and a 72-hour RTO story.

Freeze the packet — the signed file stack (MSA plus any BCDR schedule). Circle the backup sentence. Write RTO = ___ hours and RPO = ___ hours or minutes. If both are empty, write “clocks silent.” NIST CSRC defines recovery time objective in a vendor contract as how long a system may stay in recovery before the mission is harmed — US structure, not England-and-Wales statute. Recovery point objective is the point in time to which data must be recovered — the rpo backup age commitment. For example, Niko’s heading names neither clock. Do: fill two blanks or write silent. Don’t: treat “we back everything up” as hours.

What to demand instead of commercially reasonable backup?

A recovery time objective in a vendor contract is hours on named systems, not an adjective. Circle clause 11.4 and write “systems: none / hours: none.” Demand an exhibit — an attached schedule — that names the ledger, payout file, identity store, and a default for anything unlisted.

If it is not on the list, expect a coverage fight. Granite GRC calls commercially reasonable efforts dangerous ambiguity. Jones IT is blunt: no named numbers means no measurable recovery commitment. In practice, “we have SOC 2” does not print hours onto 11.4 — Type II PDF is a different hunt on the vendor security addendum checklist. Do: name systems plus hours. Don’t: accept the slogan as market.

What does a 2019 tabletop fail as disaster-recovery test evidence?

A policy PDF or a seven-year-old tabletop is not a written 2026 result. Demand a last test date and actual versus target on the same page. Niko’s November 2019 minutes predate the 31 March 2025 mapping deadline. That is the hidden risk in the “we tested once” file.

A disaster recovery test report cadence starts with a dated written pack: scope, systems, recovery point, start and end, observed RTO and RPO, issues, owners. Different Dev (27 July 2026) is clear: an annual tabletop may satisfy a basic policy but does not prove current restore. A four-hour target that takes seven hours has failed. FCA “one year on” wants third-party testing outcomes in the map, not only tech. Annual full exercise is baseline colour, not a seven-year gap. Do: refuse 2019 minutes. Don’t: file a policy PDF as evidence.

Which force-majeure line can excuse the BCDR plan?

A force-majeure clause two sections later can cancel the recovery Niko thinks he bought. Write one sentence on the DR schedule: force majeure does not limit the duty to implement the BCDR plan and hit the restoration times. Then stop. Do not retell the event list here.

Morgan Lewis (23 July 2021) says an FM event does not excuse the duty to restore. Tech Contracts one-liner: the FM section does not apply to disaster-recovery obligations. Event list, notice, longstop, or product-sunset-as-FM is a different hunt — force majeure first-pass. Do: carve BCDR out of FM. Don’t: assume a disaster heading already did that work.

When to lock who you call, and when, during a failover?

Acknowledgement is not restore. Name a role — not support@ — a channel that works at 02:00, and acknowledgement minutes. Write whether Niko may declare failover or only the vendor can. A tabletop does not prove the phone tree.

Circle “we will email.” LegalClarity treats a 15-minute critical acknowledgement as a start clock, not resolution. If they offer service credits instead of hours, that is a different hunt on the SLA service-credits checklist. Credits rarely make a payout weekend whole. Do: write role, channel, ack minutes. Don’t: wait until the outage to find the number.

How do you match, add an exhibit, or walk?

Match only if named systems, RTO and RPO in hours, a last written test within 12 months with actual versus target, FM that does not excuse BCDR, and a named failover contact are on the paper. Silent hours plus a 2019 PDF is add-exhibit or walk — not a green light.

Success bar before FAQ: fill the one-page log — two clocks, named systems, last test date plus actual-versus-target, FM carve-out, failover contact — and point to one sentence that would pause Monday. “Commercially reasonable backup” and “we have SOC 2” are not that sentence if the paper has no hours and a 2019 tabletop. SYSC 8.1.8R(11) colour — only if this outsourcing is a critical function in that perimeter — wants a written plan and periodic testing. Optional: a Checkory first-pass — a machine extract before a human reads every page — on the same PDF at document analysis, then a human opens every High flag — a high-severity hit a human must verify — and the 2019 date. Counsel — a solicitor who can bind a decision — still owns the walk.