Two numbers decide whether a recovery plan is real or decorative. Most people quote both and mean neither.
RPO and RTO. Recovery point: how much data you can afford to lose, measured in time. Recovery time: how long you can afford to be down. One is about the past, one about the future, and the space between what people write down and what they've actually built for is where disasters get expensive.
A four-hour RPO means you're replicating often enough that, on your worst day, you lose at most four hours of work. Not "we back up nightly and hope." A one-hour RTO means you can stand the whole thing back up, tested, inside an hour. Not "the backup exists somewhere."
Here's the tell. Ask what the numbers are and you get a confident answer. Ask when they were last proven and the room goes quiet. The figures live in a policy document. The capability to hit them lives in infrastructure nobody has exercised since it was signed off.
The two numbers aren't a target you declare. They're a bill you pay, in replication frequency, in standby capacity, in the rehearsal time to know the failover actually works.
So the honest question isn't "what's your RPO and RTO." It's "what are they, and when did you last hit them under pressure."