What measures should a disaster recovery manager assess to determine residual risk compared to inherent risk?

The correct choice is focused on the components crucial for evaluating residual risk in the context of inherent risk in disaster recovery management. Risk transference, risk acceptance, and risk mitigation are all strategies employed in risk management, and they serve distinct yet interconnected purposes in addressing risks.

Risk transference involves shifting the impact of a risk to a third party, such as through insurance or outsourcing. This measure helps in understanding how some inherent risks can be offloaded, thus reducing the organization’s direct exposure to those risks.

Risk acceptance refers to the decision to acknowledge the risk and not take any immediate action to mitigate it. This is significant in cases where the cost of mitigating a risk may outweigh the benefits, and it indicates an understanding of the organization's risk tolerance and capacity to absorb potential negative impacts.

Risk mitigation involves implementing measures to reduce either the likelihood or the impact of identified risks. This can be through various means, such as implementing security controls, policies, or procedures that lower inherent risk levels.

Together, these three strategies provide a comprehensive approach to analyzing residual risk. By assessing these actions, a disaster recovery manager can determine how much of the inherent risk remains after applying risk strategies, thus clearly distinguishing between inherent and residual risks. This framework enables informed decision-making and prioritization