A policy requires encrypted resources, approved Regions, and centralized audit logs across accounts. What is the best governance design?

1. Assume creating an organization makes every workload compliant automatically.
2. Use an account-governance baseline with preventive and detective controls, then verify workload-specific requirements.
3. Use only a public spreadsheet listing approved Regions.
4. Grant all teams unrestricted rights to disable central logging.