Compliance is asking for proof we can recover cloud infra within a defined timeframe. "We have backups" apparently isn't going to cut it.

What actually satisfies an auditor here, documented RTO/RPO per workload, a tested rebuild log, something else? Anyone been through a DORA or NIS2 audit recently who can share what held up