A security operations provider detects an incident but waits six hours to notify the customer because no threshold was agreed. What should be improved?

1. Only the provider's monthly invoice format
2. Route every raw supplier alert directly to all executives
3. Require only a more detailed monthly supplier performance report
4. Contractual incident criteria, notification timing, and escalation responsibilities