A team wants to use a new cloud service for regulated data before checking its supported compliance features. Which approach best fits?

1. Apply equivalent required data protection and access governance to recovery environments.
2. Perform a service-specific control assessment before production use.
3. Document data flows and evaluate each service and export against the required controls.
4. Define appropriate log retention, access separation, and integrity controls.