A process relies on a SaaS provider, but no internal owner is assigned because the system is outsourced. What is the primary governance gap?

1. The lack of a second SaaS provider in every case
2. A need to classify all SaaS as automatically unacceptable
3. The absence of internally owned servers
4. Unclear accountability for supplier-related business exposure