A policy requires encryption keys to remain under an approved external key-management system for a supported Google Cloud integration. Which approach best fits?

1. Restore authorized access to the required key and investigate the disabling event.
2. Retain required historical key versions until dependent data and recovery needs are verified.
3. Use Cloud HSM with suitable key configuration.
4. Evaluate Cloud External Key Manager and the service's compatibility and availability requirements.