Which of the following is a risk practitioner's BEST recommendation regarding disaster recovery management (DRM) for Software as a Service (SaaS) providers?

Conducting incremental backups from a SaaS environment to a local data center might not be feasible for all SaaS solutions and doesn't guarantee service availability.

Implementing segregation of duties relates to internal controls within an organization, not directly to a SaaS provider's disaster recovery capabilities.

When using SaaS, the customer typically has limited control over the underlying infrastructure and disaster recovery processes. Therefore, the most effective way for a risk practitioner to manage DR for SaaS is to ensure that the SaaS provider's disaster recovery capabilities and expected service availability are explicitly documented and enforceable within the Service Level Agreement (SLA) or contract. This establishes clear expectations and accountability for service continuity.

Performance benchmarking evaluates current service quality but does not guarantee or enforce disaster recovery capabilities during an actual disaster.