An analyst shares an incident report outside the organization. What should determine which sensitive details can be included?

1. Whether the recipient asks informally
2. Whether the report fits into one email
3. Classification, need-to-know, approved recipients, and disclosure requirements
4. Whether the raw evidence is easy to attach