An audit trail must remain available for a required period and protected from unauthorized deletion. Which approach best fits?

1. Define appropriate log retention, access separation, and integrity controls.
2. Apply equivalent required data protection and access governance to recovery environments.
3. Perform a service-specific control assessment before production use.
4. Document data flows and evaluate each service and export against the required controls.