A company relies on an ICS to perform equipment monitoring functions that are federally mandated for operation of the facility. Fines for non-compliance could be costly. The ICS has known…

The ICS is federally mandated for facility operation, so removing it from production would create a direct compliance violation and trigger the costly fines the company is trying to avoid.

Risk transfer is not limited to insurance - it can also be achieved through contractual indemnification agreements with vendors, outsourcing ICS operations to a third-party managed service provider who assumes liability, or service-level agreements that shift financial responsibility for incidents to an external party. This approach is preferred over acceptance because it actively redistributes the financial and operational impact of a breach rather than leaving the company fully exposed to the known vulnerabilities and associated fine risk.

Restricting access to the ICS reduces the attack surface but does not remediate the known, unpatched vulnerabilities - a sufficiently motivated attacker or malicious insider could still exploit them.

Accepting the risk without a firm upgrade commitment leaves the company fully exposed to known exploitable vulnerabilities indefinitely, which is the least protective posture when alternative risk management options are still available.