A company runs a legacy payment application on an outdated operating system that cannot be patched to remediate a known critical vulnerability. Business requirements prevent decommissioning the system for another 18 months. To reduce risk in the interim, the security team places the server on an isolated network segment behind a dedicated firewall with strict access rules and enhanced logging. Which type of security control does this MOST accurately describe?