A control operates as designed but does not address the relevant threat. What distinction is important?

1. Only the purchase price determines assurance
2. The threat must be a false positive
3. A successful installation proves risk elimination
4. Implementation success is not the same as effectiveness