A project stores copies of confidential data in two cloud environments. Which TWO governance activities are appropriate? Select TWO.

1. Track ownership, retention, and permitted data movement
2. Treat all backups as outside the organization's security scope
3. Assume the original environment's policy automatically protects every exported file
4. Define and enforce access rules for each copy and its users