A company stores confidential reports in S3. It requires server-side encryption and must control the key policy, audit use of the encryption key, and disable that key when access must be suspended. Which option best meets these key-management requirements?

1. SSE-KMS with only an AWS managed key, assuming its policy can be edited freely.
2. SSE-S3, relying exclusively on the S3-managed encryption key.
3. An S3 access point without configuring any server-side encryption.
4. SSE-KMS with a customer managed KMS key and appropriately scoped key permissions.