A third-party contract delegates incident handling but says nothing about notifying the customer. What is the primary risk-management gap?

1. The absence of a particular document font
2. The absence of a customer-owned copy of the supplier's source code
3. Unclear communication obligations and accountability during an incident
4. The supplier's use of a different incident severity scale