When an organization cannot immediately patch a critical legacy system due to stability concerns, what is the recommended approach for managing the associated vulnerability?

### The concept When a direct fix is unavailable or unsafe, an organization can reduce exposure with compensating controls. Network segmentation limits the paths an attacker can use. Restricted communication, least privilege, and disabling unnecessary services reduce attack opportunities. Enhanced logging may improve detection but does not remove the weakness. The organization should document who accepts the risk, why the system remains in service, what controls are active, when the decision will be reviewed, and how the system will eventually be replaced or fixed. ### What a good answer covers - Several specific compensating controls, such as isolation, restricted traffic, and monitoring. - Recognition that controls reduce risk but may not eliminate the vulnerability. - A named risk owner and documented business reason. - Review timing and a longer-term remediation or replacement plan. ### Terms - **Safety-critical system**: A system whose failure may create significant safety consequences. - **Least privilege**: Limiting access to what users and services need. ### Remember If you cannot patch now, reduce exposure, monitor closely, assign ownership, and set a review date.