Which of the following would BEST prevent an unscheduled application of a patch?

Network-based access controls restrict who can access certain network resources, but they do not inherently manage the scheduling or approval process for applying patches to systems.

Compensating controls are alternative controls used when primary controls are not feasible; they do not directly prevent unscheduled patch applications but rather mitigate risks when primary controls are absent.

Segregation of duties aims to prevent fraud or error by dividing critical tasks among multiple individuals, but it doesn't directly enforce the scheduling and approval process for changes like change management does.

Change management is a formal process that governs all modifications to IT systems, including patch applications. It mandates planning, assessment of impact, approval, communication, and scheduling before any change is implemented, thereby preventing unauthorized or unscheduled deployments.