A critical manufacturing control system runs on an unsupported operating system that cannot be patched without the vendor recertifying the whole production line, which will take two years. What is the BEST course of action?
Select an answer to reveal the explanation.
Short Explanation
If you can't fix the lock on a door you need to keep using, you put a fence around it and make sure the homeowner knows and signs off. That's compensating controls plus formal acceptance. The traps are shutting the factory, forcing a patch that breaks certification, or simply looking away.
Full Explanation
When a vulnerability cannot be remediated directly, risk is treated by reducing exposure through compensating controls and making the remaining risk an explicit business decision. For an unpatchable control system, segmentation that isolates it from general networks, strict access control, application allowlisting and enhanced monitoring reduce the likelihood of compromise. The risk owner, who is accountable for the production line, then formally accepts the residual risk for a defined period while the upgrade proceeds. Shutting down the line for two years is disproportionate and is a business decision that ignores available mitigation. Applying patches against the vendor's requirements may invalidate certification, cause safety or availability failures and still leave the system unsupported. Recording an exception and removing the system from scanning hides the risk instead of managing it, and it removes visibility of new weaknesses. Exam caveat: the security manager recommends and documents, but the acceptance decision belongs to the business risk owner with the appropriate authority. Operational check: confirm the segmentation is verified by testing, that the acceptance is signed by the risk owner with an expiry date aligned to the upgrade plan, and that the system remains in monitoring.