A cold site is a disaster recovery option that provides only basic infrastructure (such as power, space, and network connectivity) but does not have pre-installed IT equipment such as servers and storage.
Organizations must procure and install servers and restore data before resuming operations, leading to longer recovery times.
Let's analyze each option:
* Option A: Data is synchronized in real-time
* Incorrect.
* Real-time data synchronization is a feature of hot sites, which have fully operational infrastructure and data replication.
* Cold sites do not support real-time synchronization because they lack servers and storage.
* Option B: Recovery time is expected to be less than one week
* Incorrect.
* Cold sites require significant setup time since servers and infrastructure must be procured, configured, and installed.
* Recovery time can often exceed one week, depending on the complexity of IT systems.
* Option C: Servers are not available and need to be procured
* Correct.
* A cold site lacks computing hardware (e.g., servers, storage, network devices), meaning the organization must purchase or transport servers to the site before recovery can begin.
* IIA Reference: Internal auditors assess disaster recovery strategies, including the limitations of cold sites and their impact on business continuity. (IIA GTAG: Auditing Business Continuity and Disaster Recovery)
* Option D: Recovery resources and data restore processes have not been defined.
* Incorrect.
* Even though a cold site lacks IT infrastructure, the organization still has a disaster recovery plan, which includes predefined recovery steps, resource planning, and data restoration procedures.
Thus, the verified answer is C. Servers are not available and need to be procured.