A production appliance cannot be patched until a planned outage. Which response best manages the interim risk?

1. Document ownership, apply tested compensating controls, and set an expiry for the exception
2. Remove the appliance from inventory
3. Disable all monitoring to avoid duplicate alerts
4. Call the vulnerability fixed because a future outage is scheduled