One of an organization's key IT systems cannot be patched because the patches interfere with critical business application functionalities. Which of the following would be the risk practitioner's…

If patches cause critical application functionality issues, the system remains vulnerable. Identifying and implementing additional mitigating controls (e.g., network segmentation, intrusion detection, hardening configurations, application-level controls) can reduce the likelihood or impact of exploitation without disrupting the critical business application.

Prohibiting the use of a key IT system until the application is changed is often impractical and can severely disrupt critical business operations, making it an extreme and often unacceptable recommendation.

Adjusting the organization's IT risk appetite is a strategic decision that changes the acceptable level of risk, rather than a direct technical or operational control recommendation for a specific identified vulnerability.

Accepting the risk should only be considered after all viable mitigation options have been explored and determined to be unfeasible or too costly, and it requires formal approval, not as a primary best recommendation for an unpatched critical system.