During an audit, it was identified that a critical application hosted in an off-premises cloud...

The auditor’s next course of action should be to review the contract and DR capability of the cloud service provider. This will help the auditor to verify if the provider has a DR plan that meets the organization’s requirements and expectations, and if the provider has evidence of testing and validating the plan annually. The auditor should also check if the contract specifies the roles and responsibilities of both parties, the RTO and RPO values, the SLA terms, and the penalties for non-compliance.

Reviewing the security white paper of the provider (option A) might give some information about the provider’s security practices and controls, but it might not be sufficient or relevant to assess the DR plan. Reviewing the provider’s audit reports (option B) might also provide some assurance about the provider’s compliance with standards and regulations, but it might not address the specific DR needs of the organization. Planning an audit of the provider (option D) might be a possible course of action, but it would require more time and resources, and it might not be feasible or necessary if the contract and DR capability are already satisfactory. References:

Disaster recovery planning guide

Audit a Disaster Recovery Plan

How to Maintain and Test a Business Continuity and Disaster Recovery Plan