Compensating controls, segmentation and exceptions for systems that cannot be patched

Sometimes the right fix for a vulnerability cannot be applied. A medical device may be certified only with a specific operating system version, an industrial controller may need a plant shutdown to update, a vendor may no longer support a product, or a patch may break a critical application. In these cases you still have to manage the risk, and CySA+ tests how you do it: with compensating controls, segmentation and a documented exception.