The percentage of IT systems routinely running at peak utilization serves as a leading indicator of potential future availability issues. Systems operating at or near full capacity are more susceptible to performance degradation or outages, which can impede their ability to meet service level agreements (SLAs). Monitoring this KRI allows organizations to proactively address capacity constraints before they impact system availability.
Reference:ISACA CRISC Review Manual, 7th Edition, Chapter 4: Information Technology and Security, Section: Key Risk Indicators.

* Once a risk owner has decided to implement a control to mitigate risk, it is most important to develop a process for measuring and reporting control performance. This process helps to monitor and evaluate the actual results and outcomes of the control, compare them with the expected or desired objectives and standards, identify any gaps or issues that may affect the control's effectiveness or efficiency, and report them to the relevant stakeholders for decision making or improvement actions.
* An alternate control design in case of failure of the identified control is a contingency plan that can be used to reduce the impact of a control failure or breakdown. It is not the most important thing to develop after implementing a control, but rather a backup option that can be activated when needed.
* A process for bypassing control procedures in case of exceptions is a mechanism that allows authorized users to override or circumvent a control in certain situations, such as emergencies, errors, or special requests. It is not the most important thing to develop after implementing a control, but rather a risk response that can be applied when necessary.
* Procedures to ensure the effectiveness of the control are the steps or actions that are required to implement, operate, and maintain the control in accordance with the risk owner's expectations and requirements. They are not the most important thing to develop after implementing a control, but rather a part of the control design and implementation process.
The references for this answer are:
* Risk IT Framework, page 13
* Information Technology & Security, page 7
* Risk Scenarios Starter Pack, page 5

Risk impact is the potential loss or damage that a risk event can cause to an organization. Risk impact can be expressed in qualitative or quantitative terms, such as financial, reputational, operational, or legal. A risk register is a tool that records and tracks the key information about the identified risks, such as their description, likelihood, impact, response, and status. A risk register helps an organization to monitor and manage its risks effectively and efficiently. When there is a change in the external or internal environment that affects the organization's risks, such as new regulations, the risk register should be updated to reflect this change. The most important element of the risk register to update in this case is the risk impact, because the new regulations have significantly increased the penalties for data breaches, which means that the potential loss or damage that a data breach can cause to the organization has also increased. By updating the risk impact, the organization can reassess the severity and priority of the data breach risk, and adjust its risk response accordingly. The other elements of the risk register are less important to update in this case. The risk trend shows the direction and rate of change of the risk over time, which may or may not be affected by the new regulations. The risk appetite is the amount and type of risk that the organization is willing to accept in pursuit of its objectives, which is unlikely to change due to the new regulations. The risk likelihood is the probability of a risk event occurring, which is also independent of the new regulations. References = Risk IT Framework, ISACA, 2022, p. 131

Key control indicators (KCIs) are metrics that measure how well a specific control is performing in reducing the causes, consequences, or likelihood of a risk1. KCIs are used to evaluate the control operating effectiveness, which is the degree to which a control achieves its intended objectives and mitigates the risk2.
The primary reason to use KCIs to evaluate control operating effectiveness is to monitor the achievement of set objectives. This means that KCIs help to:
Track and report the progress and performance of the control against the predefined targets, standards, or benchmarks Identify and address any gaps, deviations, or issues in the control operation or outcome Provide feedback and assurance to the stakeholders and regulators on the adequacy and reliability of the control Support the continuous improvement and optimization of the control3 References = Key Control Indicator (KCI) - CIO Wiki, Evaluating and Improving Internal Control in Organizations - IFAC, A Methodical Approach to Key Control Indicators

Disaster Recovery (DR) focuses on restoring IT and business services to support essential operations after a disruption.
ISACA defines:
"The primary objective of disaster recovery is the timely restoration of critical IT systems and services necessary to support business operations." Recovery of financial records or facilities are secondary components.
Therefore, B. Restore critical business and IT services is correct.
CRISC Reference: Domain 3 - Risk Response and Mitigation, Topic: Business Continuity and Disaster Recovery Planning.