A security program's priorities remain unchanged after major business divestment. What is the best next step?

1. Continue because the old plan was once approved
2. Review the strategy, asset scope, obligations, and funding against the new business context
3. Discard every control immediately
4. Increase all controls equally