Question

During a disaster recovery review, an IS auditor notes that a critical order-processing application has a documented recovery time objective (RTO) of two hours, but the current recovery strategy relies on restoring from tapes shipped from an offsite vault, which historically takes eight hours. Which of the following is the auditor's MOST appropriate conclusion?

Accepted Answer

The recovery strategy is inadequate because it cannot meet the established RTO, and the gap should be reported

Answer

The RTO should be lengthened to eight hours to align with the tape restoration capability

Answer

The recovery point objective (RPO) should be reduced to compensate for the slow restoration time

Answer

The strategy is acceptable as long as backups are completed and verified daily