A security manager must reduce costs without undermining required protection. What should be evaluated first?

1. Equal percentage cuts to every control regardless of risk
2. Eliminating all validation activities
3. The cheapest product in each category only
4. Control coverage, duplication, effectiveness, and business-critical dependencies