· ReadyStack
Worked example
Real numbers from this tool, line by line.
$10,000.00 of downtime cost lands past the MTD for a US online store's order system whose disaster recovery plan looks compliant on paper: the vendor promises a 20-hour RTO, the owner accepts a 24-hour MTD, but re-keying lost orders takes another 8 hours. At $2,500 an hour in lost sales, the outage runs 28 hours, 4 hours past the MTD.
| Sample order system | Result |
|---|---|
| Template check: RTO 20 h vs MTD 24 h | passes |
| Real outage: RTO + reprocessing | 28 h |
| Hours past the MTD | 4 h |
| Longest RTO that still meets the MTD | 16 h |
| Downtime cost past the MTD | $10,000.00 |
| Downtime cost of the whole outage | $70,000.00 |
| Backup gap beyond the 4 h RPO | 20 h |
| Records lost in a worst-case restore | 720 |
| Records lost beyond what the RPO allows | 600 |
The line most DR plan templates skip
NIST SP 800-34 Revision 1 defines three numbers for each system. The MTD is the total outage the system owner is willing to accept. The RTO is how long the system can stay down. The RPO is the point in time to which data can be recovered from the most recent backup. Then it adds the sentence most templates leave out: because the RTO must ensure that the MTD is not exceeded, the time it takes to reprocess data must be added to the RTO to stay within the MTD.
A blank template gives you three boxes. You type 24, 20 and 4, and nothing tells you that 20 + 8 is 28.
The RPO check
RPO is not part of the MTD. It is how much data loss the process can tolerate. The worst case is a disruption just before the next backup, so the real exposure is the backup interval. With a nightly backup and a 4-hour RPO, the gap is 20 hours. At 30 orders an hour that is up to 720 orders lost, 600 more than the RPO allows.
Three situations, three different answers
- The sample: MTD 24 h, RTO 20 h, 8 h reprocessing, nightly backup, RPO 4 h, $2,500 an hour, 30 records an hour. Fails by 4 hours, $10,000.00 past the MTD, 600 records beyond the RPO.
- Same store, vendor RTO cut to 12 h and backups every 4 h. Outage 20 h, inside the MTD; the whole outage still costs $50,000.00 and no records fall past the RPO.
- A clinic's records system: MTD 12 h, RTO 8 h, 6 h reprocessing, backups every 12 h, RPO 1 h, $1,200 an hour, 15 records an hour. Outage 14 h, 2 hours past, $2,400.00 past the MTD; the RTO must be 6 h or less; 165 records beyond the RPO.
Who has to get this right
IT managers, MSPs and practice managers who sign a disaster recovery plan for an owner, an auditor or a cyber insurer. HIPAA covered entities must have one: 45 CFR 164.308(a)(7)(ii)(B) lists a disaster recovery plan as Required. Federal mission essential functions must meet an MTD of 12 hours or less under FCD-1, as SP 800-34 notes.
Check your own system free
The calculator runs in your browser. Type seven numbers for one system: MTD, RTO, reprocessing hours, backup interval, RPO, downtime cost per hour and records per hour. You get 11 figures, two NIST pass/fail lines and the hour the loss starts. Nothing is uploaded. The workbook version keeps the same live formulas in an .xlsx, one tab per system, to file with your plan.
15 seconds — what it actually does
Questions people ask
What does this disaster recovery plan calculator check?
It takes one system's numbers from your disaster recovery plan and runs two NIST SP 800-34 checks. First, restore time plus the hours to reprocess lost data must fit inside the maximum tolerable downtime. Second, the backup interval must fit inside the recovery point objective. It then prices the hours past the MTD with your own downtime cost.
Who is this for?
IT managers, MSPs and practice managers who must hand a written disaster recovery plan to an owner, auditor or cyber insurer. That includes HIPAA covered entities, where 45 CFR 164.308(a)(7)(ii)(B) lists a disaster recovery plan as Required, and anyone following NIST SP 800-34 Revision 1 for federal or contractor systems.
Why not just download a free disaster recovery plan template?
Free templates, NIST's own Appendix A samples included, give you blank MTD, RTO and RPO boxes. Nobody adds the reprocessing time to the RTO, so a 20-hour RTO under a 24-hour MTD looks fine while the real outage runs 28 hours. This page does that sum and shows the cost of the gap.
What is free and what costs money?
The full check for one system is free in your browser, as often as you like, with no account. Every figure shows on screen. The paid version is the .xlsx workbook with live formulas plus an offline .html copy, so you can keep one tab per system and attach the numbers to the plan you file.
What does it cost to have a person do this?
Information security analysts earned a median $62.11 an hour in May 2025, according to the US Bureau of Labor Statistics. Working out MTD, RTO and RPO for each system is part of their job. This page does the arithmetic check for one system free, and the workbook is a one-time payment, not a subscription.
Ask about this tool
One question, answered by the person who built it. Your email only if you want the answer sent.