A preventive control is unavailable for a legacy system. What should the practitioner consider?

1. Automatic permanent acceptance without business authority
2. An undocumented promise to be careful
3. A tested compensating control that addresses the relevant exposure with governed residual risk
4. An unrelated control with the same purchase cost