The key performance indicator (KPI) that best measures the effectiveness of an organization's disaster recovery program is the percentage of critical systems recovered within the recovery time objective (RTO).
The RTO is the acceptable timeframe within which a business process or system must be restored after a disruption. The percentage of critical systems recovered within the RTO indicates how well the disaster recovery program can meet the business continuity requirements and minimize the impact of the disruption.
The other options are not as good as the percentage of critical systems recovered within the RTO, as they are related to the efficiency, quality, or scope of the disaster recovery program, not the effectiveness of the disaster recovery program. References = Risk and Information Systems Control Study Manual, Chapter 4:
Risk and Control Monitoring and Reporting, Section 4.2: Key Performance Indicators, page 183.

The best way to reduce the risk associated with the theft of a laptop containing sensitive information is to use data encryption. Data encryption is a process that transforms the data into an unreadable or unintelligible format, using a secret key or algorithm, to protect the data from unauthorized access or disclosure. Data encryption helps to reduce the risk of data theft, because even if the laptop is stolen, the data on the laptop cannot be accessed or used by the thief without the proper key or algorithm. Data encryption also helps to comply with the relevant laws, regulations, standards, and contracts that may require the protection of sensitive data. The other options are not as effective as data encryption, although they may provide some protection for the laptop or the data. A cable lock, a periodic backup, and a biometrics access control are all examples of physical or logical controls, which may help to prevent or deter the theft of the laptop, or to recover or restore the data on the laptop, but they do not necessarily protect the data from unauthorized access or disclosure if the laptop is stolen. References = 8

The risk profile is the most important document to update following a change in organizational risk appetite and tolerance, because it summarizes the current and target state of the organization's risk exposure, as well as the risk response strategies and actions. The risk profile should reflect the alignment of the organization's risk appetite and tolerance with its strategic objectives and operational capabilities. Updating the risk profile will help the organization to monitor and manage its risks effectively and efficiently.
References
*ISACA CRISC Review Manual, 7th Edition, Domain 1: IT Risk Identification, Section 1.2.1: Risk Profile
*Risk Profile - ISACA
*What is a Risk Profile? Definition, Examples, and More

The risk owner should be someone who has the authority, responsibility, and knowledge to manage the risk effectively and align it with the organizational strategy and objectives. The risk owner should also be able to communicate the impact of the risk on the business operations and the value proposition of the risk response.
Understanding the effect of loss events on business operations is a key criterion for assigning risk owners, as it helps to prioritize and mitigate the risks that matter most to the organization.
References
*Why Assigning a Risk Owner is Important and How to Do It Right
*How to Write Strong Risk Scenarios and Statements - ISACA
*What Everybody Ought To Know About Project Risk Owners