An employee who reports a security error honestly is protected by management. What does this support?

1. A constructive security reporting culture
2. Automatic risk acceptance
3. Elimination of incident documentation
4. Removal of access reviews