A vendor promises a control will reduce risk by 90%, but provides no environment-specific evidence. What should happen before relying on the estimate?

1. Infer effectiveness from the license price
2. Use the claim as a guaranteed residual-risk value
3. Validate relevant effectiveness through suitable testing or credible applicable assurance
4. Ignore every vendor-provided fact categorically