A company selects SaaS for payroll. Which activity remains essential for its security team despite outsourcing the application stack?

1. Treat the supplier's certification as proof of every tenant setting
2. Stop reviewing account lifecycle because the service is hosted
3. Patch the provider's hypervisor directly
4. Review tenant access, data handling, and supplier assurance