Security wants evidence that a preventive control works before rolling it out to all organizational units. Which rollout approach is best?

1. Deploy globally without testing because a deny can never disrupt a business process.
2. Review only the policy filename and assume its contents are correct.
3. Test representative allowed and denied operations in a limited scope, monitor impact, and expand deliberately.
4. Disable audit logging during rollout to reduce the number of findings.