Define acceptable loss
RTO states how long the service may be unavailable; RPO states how much data loss is acceptable. Accounting, warehouse and production workloads may require different objectives.
Separate failure domains
A 1C cluster distributes work and can tolerate selected process or node failures, but it does not replace database high availability. A PostgreSQL replica does not protect against logical deletion or corruption that is replicated successfully.
Design application nodes, database primary and standby, quorum and fencing, shared dependencies, backups and a recovery site as distinct layers.
Test the complete service
A restore test ends when users can enter 1C, recent documents are validated, scheduled jobs and integrations work, and permissions are correct. For physical PostgreSQL recovery, preserve both a base backup and a continuous WAL chain. Run exercises that prove ownership, instructions and actual RTO/RPO.