A healthcare organization has identified that a legacy medical imaging system contains a critical vulnerability that could expose patient data. The system cannot be patched due to vendor end-of-life status, and replacing it would cost $850,000 with an 18-month implementation timeline. A security assessment determines the annual loss expectancy (ALE) is $45,000. The organization purchases a cyber insurance policy with a $50,000 annual premium that covers losses from this specific risk. Which risk management strategy is the organization implementing?