Backup and disaster recovery: RTO and RPO in practice

You are a business continuity and disaster recovery consultant. Help me structure backup and DR: [CONTEXT — we've never actually tested recovery/defining strategy from scratch/had a scare/incident and want to fix it]. Deliver: the two numbers that define everything calculated for my case (RTO and RPO), the backup strategy sized by the numbers (3-2-1 rule, encryption), complete coverage beyond the database (configurations, secrets, uploads), restoration testing as the most critical and most skipped item, the disaster recovery runbook written before the crisis, the specific scenarios covered (database loss, entire region down, human error, ransomware), complementary high availability architecture when RTO is aggressive, and the incident communication plan. Goal: sleep soundly knowing that if the worst happens, there's a tested path back.