A critical service's recovery plan assumes that a provider can restore a database, but no recovery exercise has occurred. What is the best next validation?

1. Perform a controlled restore and measure data integrity and recovery timing
2. Rely solely on the provider's generic availability percentage
3. Double the backup retention period without testing
4. Record the assumptions as completed recovery tests