What are RPO and RTO?
They are the two numbers that turn a backup plan into a business decision. The recovery point objective (RPO) is how much data you can afford to lose, measured in time: with nightly backups your RPO is up to 24 hours, meaning a day's work could be gone. The recovery time objective (RTO) is how long a system may be down before the damage becomes unacceptable, measured from the incident until the system is running again. Set both per system with the people who own the business process, not only with IT: the accounting system might tolerate a two-day outage but no data loss, while a web shop might be the reverse. Then check whether your backups and restore tests actually achieve them. A restore that takes three days in a test cannot meet an RTO of four hours, however good the backup software is.