An IS auditor is reviewing a bank’s service level agreement (SLA) with a third-party provider that hosts the bank’s secondary data center.
Which of the following findings should be of GREATEST concern to the auditor?
A . The recovery point objective (RPO) has a shorter duration than documented in the disaster recovery plan
B . The recovery time objective (RTO) has a longer duration than documented in the disaster recovery plan
C . Backup data is hosted online only
D . The SLA has not been reviewed in more than a year
Answer: B