In response to a question posed by an internal auditor, management indicated that there is...

The arrangement described is a cold recovery plan because the organization has an agreement to obtain equipment and restore data from off-site tapes, but the recovery site is not already fully configured and operational. A hot site would have systems, infrastructure, and data ready for rapid failover, often with real-time or near-real-time synchronization. A warm site would typically have some configured hardware and infrastructure already available, although not fully current. “No recovery plan” is incorrect because management has at least arranged for equipment rental and off-site backup restoration. Internal auditors should evaluate whether the selected recovery approach meets recovery time objectives, recovery point objectives, and business impact analysis requirements. Therefore, Option C is correct.