Translating Recovery Objectives into Funded Infrastructure Requirements: A Mixed-Methods Study of Enterprise IT Governance

Abstract

Recovery objectives are frequently defined by business stakeholders but translated into infrastructure budgets through informal engineering judgement. We used a sequential mixed-methods design to examine how recovery time and recovery point requirements are converted into funded technical controls. Quantitative data were collected from 54 application portfolios across eight organisations, followed by 29 interviews with service owners, infrastructure architects, risk managers, and finance representatives. Stricter recovery targets were associated with higher annual resilience expenditure, but the relationship was non-linear and strongly influenced by application dependency count and testing frequency. Applications with recovery-time objectives below one hour cost a median 2.3 times more to protect than those in the four-to-eight-hour category. Interview data showed that funding disputes most often arose when business impact assumptions were undocumented or when shared infrastructure costs could not be attributed to individual services. Organisations using tiered service classifications and scenario-based cost models reported fewer late-stage budget changes. Effective translation of recovery objectives therefore requires a traceable link between business impact, technical architecture, test evidence, and incremental cost rather than treating RTO and RPO values as isolated engineering targets.