A supplier handles sensitive data, but provides only a generic security brochure. What evidence should the manager seek?

1. Assurance relevant to the actual service, controls, scope, and obligations
2. A contractual statement that the supplier uses industry-standard security, without supporting scope
3. The supplier's advertising budget
4. A certification held by the supplier's corporate training department