A cloud provider supplies many controls, but the business assumes it has transferred all security accountability. What should the manager clarify?

1. The security manager should stop monitoring the service
2. Responsibilities must be explicitly allocated; the organization retains accountability for its own obligations
3. The provider is automatically responsible for every customer configuration
4. No contract is needed because the provider is large