A legacy integration uses an unsupported protocol with no strong authentication. What should risk treatment consider?

1. Migration, constrained exposure, compensating controls, and explicit residual-risk ownership
2. Only a new protocol name in the documentation
3. Immediate business shutdown without dependency analysis
4. A permanent undocumented assumption that internal networks are safe