A company has daily database backups but has never restored them. Management asks whether the system meets a two-hour RTO. What is the most useful next step?

1. Perform timed restoration and application validation including access, configuration, and dependencies.
2. Increase backup retention and assume recovery becomes faster.
3. Delete older backups before testing to simplify the report.
4. Use backup file size alone as proof of the two-hour RTO.