A remediation is complete, but the same weakness recurs after each deployment. What should treatment address?

1. A permanent exception without reviewing exposure
2. The systemic process causing reintroduction, with verification after change
3. Only closing each finding faster
4. The vendor's branding guidelines