A risk assessment excludes outsourced services because they are not owned internally. What should the security manager explain?

1. Relevant outsourced dependencies remain within the organization's risk analysis
2. Only internally purchased hardware creates risk
3. Suppliers automatically accept every downstream consequence
4. Outsourced services can never fail