An organization recently decided to send the backup of its customer relationship management (CRM) system to its cloud provider for recovery. Which of the following should be of GREATEST concern to an IS auditor reviewing this process?

A. Backups are sent and stored in unencrypted format.
B. Validation of backup data has not been performed.
C. The cloud provider is located in a different country.
D. Testing of restore data has not been performed.