Before signing with a cloud processor that will store sensitive customer data, what should a company prioritize?

1. Assess the provider's relevant controls and contractual obligations
2. Assume the provider takes over every customer security responsibility
3. Choose solely by the number of advertised data centers
4. Wait until the contract ends to examine incident-notification terms