A business owner asks when a recovered service can reopen. What evidence should support the decision?

1. Verified recovery criteria, residual-risk assessment, and authorized business acceptance
2. Only the supplier's statement that the incident is over
3. Only the fact that the login page loads
4. Only the number of responders available