The performance audit report of an information technology department indicated that the department lacked a disaster recovery plan. Which of the following steps should management take first to correct this condition? A. Prepare a statement of responsibilities for tasks included in a disaster recovery plan. B. Bulletproof the information security architecture. C. Designate a cold site. D. Designate a hot site