A new security policy conflicts with a business exception requested for one workload. The exception must be reviewed and time limited. Which approach best fits?

1. Map data-residency requirements to service locations, replication, backups, and processing behavior.
2. Retain approval records and appropriately protected audit evidence.
3. Document risk ownership, compensating controls, approval, and an expiry date.
4. Assess customer controls and obligations against the applicable requirements.