A company adopts a security baseline from another industry without tailoring it. What should the manager review?

1. Whether the original company is famous
2. Its fit with business risks, obligations, technology, and operating model
3. Only whether the document looks professional
4. Whether every control can be purchased from one vendor