A third-party supplier will process customer records. What should happen before granting access?

1. Assess security requirements and the supplier's controls
2. Grant production administrator rights during procurement
3. Rely solely on the supplier's logo
4. Wait for a confirmed breach before reviewing contracts