An assessment labels a supplier 'low risk' based on company size. The supplier holds all production recovery keys. What should be examined?

1. Only the number of supplier employees
2. Its actual privileged access, criticality, and failure consequences
3. The supplier's office location as the sole factor
4. Only annual supplier revenue