Which of the following key performance indicators (KPis) would BEST measure me risk of a service outage when using a Software as a Service (SaaS) vendors

The frequency of business continuity plan (BCP) testing measures the vendor's preparedness for incidents, but it does not directly measure the actual occurrence or impact of service outages.

The frequency and number of new software releases relate to change management and potential for new vulnerabilities, but not directly to the risk of *service outages* themselves.

The frequency and duration of unplanned downtime directly quantify how often and for how long the SaaS vendor's service becomes unavailable. This metric provides a clear, objective, and tangible measure of the actual service reliability and availability, which is the core risk an organization faces when relying on a SaaS provider for continuous operations.

The number of IT support staff available after business hours indicates responsiveness to issues, but it does not directly measure the likelihood or actual impact of a service outage.