CompTIA Security+ (SY0-701) SY0-701 — Question 148

Which of the following risk management strategies should an enterprise adopt first if a legacy application is critical to business operations and there are preventative controls that are not yet implemented?