A healthcare organization has identified a critical vulnerability in its legacy radiology system that could allow ransomware attacks. The system cannot be patched due to vendor end-of-life status, and replacing it would cost $2 million with an 18-month implementation timeline. The organization has determined the annualized loss expectancy (ALE) for a ransomware incident is $800,000. The CISO purchases a cyber insurance policy with ransomware coverage for an annual premium of $150,000. Which risk management strategy is the organization primarily implementing?