A security team provides a standard set of AWS Config rules with optional remediation actions. Operations must deploy them together and assess resource compliance continuously in an account. Which feature packages these controls as one deployable collection?

1. Create an SNS subscription for configuration-change notifications but omit Config rule deployment.
2. Deploy a Config aggregator without deploying any of the underlying rules.
3. An AWS Config conformance pack.
4. Create an Organizations SCP that lists the rule names and expect Config to evaluate them automatically.