A remediation plan uses a successful vulnerability scan as its only completion criterion, but the risk concerns unauthorized business transactions. What should be added?

1. An assumption that scan completion guarantees compliance
2. Only the scanner's version number
3. A larger number of unrelated scans
4. Validation that the business attack path and required control outcome are addressed