A risk owner asks for 'best practice' controls without defining the target exposure. What should the practitioner clarify?

1. The risk scenario, required outcome, obligations, and acceptance criteria
2. Only which vendor has the newest release
3. The control team's preferred purchasing schedule alone
4. A universal requirement to deploy every baseline control identically