An organization wants resource owners to periodically certify access instead of relying only on IT administrators. Which design fits?

1. Recurring access reviews with appropriate accountable reviewers
2. Review only a random unrelated user's sign-in
3. Replace reviews with a larger password minimum length
4. Make every user a reviewer of every protected resource