A company evaluates projects individually but never examines their combined dependence on one cloud region. What is missing?

1. A requirement that every project have identical controls
2. A larger inventory of unrelated desktop risks
3. A rule that cloud risk cannot be aggregated
4. An aggregated view of concentration and correlated risk