As someone who has done a fair bit of security compliance, I can say the answer is: ask your company's compliance officer.
Probably more important than setting the reset-window time, is ensuring your ping their SMS or other '2nd factor' when resetting. This is important in case someone else is trying to reset to break in. Consider that you can ping their 2nd factor (e.g. SMS) interactively, so that if they respond with 'freeze', or similar, then then you can immediately disable the password reset code.
20-minute resets are generally safe, though be mindful of whether your email deliverablity is good enough for them to get it in that window of time.
presume shorter time windows for financial logins, business SaaS, and similar critical systems. The same goes for social accounts if the account is 'high status' or the request comes from outside the normal activity profile.