A security manager wants independent assurance over the program they operate. Which arrangement is strongest?

1. The control vendor approves its own installation without review
2. An appropriately independent assurance function evaluates the program
3. Operations deletes unresolved findings before review
4. The manager alone certifies every control effective