A healthcare organization operates a legacy medical imaging system that contains vulnerabilities but cannot be patched because the vendor no longer supports it. The system processes critical patient data daily. Replacing the system would cost $500,000 and take 18 months. A recent risk assessment calculated the annualized loss expectancy (ALE) at $75,000. The organization has implemented network segmentation, strict access controls, and enhanced monitoring around this system. Which risk management strategy has the organization primarily adopted?