An incident is confirmed in a supplier-operated environment. What should the customer's incident manager do?

1. Assume the supplier will make every required customer notification
2. Demand unrelated privileged access without authorization
3. Treat the event as irrelevant because the hardware is external
4. Coordinate through contractual response channels while assessing the customer's own impact and duties