A business process tolerates a four-hour outage. A supplier's recovery commitment is twelve hours. What should the assessment highlight?

1. Only the supplier's average uptime percentage
2. Automatic compliance because a recovery commitment exists
3. A recovery capability gap against business tolerance
4. That the business must adopt twelve hours without evaluation