A team uses a benchmark to assess its Kubernetes configuration. How should deviations be handled?

1. Treat a passed scan as permanent proof of compliance
2. Evaluate context, document decisions and remediate material gaps
3. Ignore all findings that require operational work
4. Assume every recommendation is universally applicable unchanged