A public-health clinic still runs FDA-cleared diagnostic devices that the vendor will not patch this year. Vulnerability scans keep flagging them. What is the most appropriate security-operations response?
Select an answer to reveal the explanation.
Short Explanation
You can’t always slam “patch now” on a clinical box. Write the exception, fence it off the main network, watch it, and lock who can touch it—until a real fix shows up.
Full Explanation
When FDA-cleared or otherwise specialized clinical devices cannot be patched on the municipality’s preferred schedule, security operations manage residual risk through formal exception governance plus compensating controls—not denial or reckless change. Documenting an exception records why the finding remains open, who accepts the risk, review dates, and which safeguards apply until a vendor-supported fix exists. Typical compensations for clinic devices include network isolation or segmentation away from general enterprise and guest networks, heightened monitoring, strict access restrictions, and inventory visibility so the devices never become unmanaged shadow endpoints on the public-health LAN.
Ignoring findings because “medical devices are exempt from all risk acceptance” invents a blanket exemption that auditors and patients will not recognize; residual risk must still be owned. Forcing an unsupported OS upgrade during clinic hours without vendor guidance can void clearances, break diagnostics, and harm patient care—availability and safety matter as much as the scan score. Connecting devices directly to guest Wi-Fi expands exposure to untrusted clients and usually worsens, rather than improves, vendor support posture.
Exam caveat: vulnerability management includes exception and compensating-control paths when remediation is infeasible. Risk acceptance is documented and time-bounded, not silent. Healthcare and safety-critical environments often prioritize validated vendor processes over aggressive patching that could interrupt care.
Operational check: maintain an exception register for unscannable or unpatchable clinic devices, verify VLAN/ACL isolation and monitoring coverage quarterly, restrict interactive admin paths, and calendar re-engagement with the vendor for supported remediation before the exception expires.