A workload processes regulated information through several managed services and exports. The compliance review covers all processing locations. Which approach best fits?

1. Perform a service-specific control assessment before production use.
2. Apply equivalent required data protection and access governance to recovery environments.
3. Define appropriate log retention, access separation, and integrity controls.
4. Document data flows and evaluate each service and export against the required controls.