A retail group expands online sales, increasing dependence on one payment platform. What should the risk practitioner establish before recommending new controls?

1. Which available control has the most features
2. Whether the platform meets its vendor's generic checklist
3. How platform failure could affect business objectives and existing tolerance
4. How many controls the security team can implement this month