A company asks whether using a compliant cloud provider automatically makes its own application compliant. What is the best response?

1. Provider certifications support compliance, but the company must assess its own configuration, data handling, and obligations
2. Compliance can be ignored when data is encrypted
3. Only physical data-center location ever matters
4. Every application becomes compliant as soon as a billing account exists