A business-critical service depends on an unsupported operating system. What should the manager recommend?

1. Immediate destruction without continuity planning
2. An undocumented indefinite exception
3. A governed migration plan with interim controls and explicit residual-risk oversight
4. An assumption that isolation is a permanent guarantee