A regulated workload must demonstrate compliance with a group of resource configuration controls. The architect wants a reusable grouping with compliance reporting. What should be assigned?

1. An NSG with only an outbound rule
2. A naming convention alone
3. A single backup recovery point
4. An Azure Policy initiative