A cloud deployment passed an external provider audit, but the customer's storage permissions allow broad public reads. What should be concluded?

1. Customer configuration must be assessed separately from provider assurance
2. The customer should stop collecting configuration evidence
3. Public access automatically becomes acceptable after any external audit
4. The provider audit guarantees every customer's storage is private