ISC2 CISSP Practice Question

Extended Support Agreements (ESAs) provide the organization with continued security updates and patches from the vendor after the standard support period ends. This is particularly important for mission-critical systems that cannot be immediately migrated or replaced. While air-gapping systems or implementing additional security controls may help reduce risk, they don't address the fundamental issue of missing security patches for newly discovered vulnerabilities. Accepting the risk without mitigation would be inappropriate for a financial institution dealing with critical systems. ESAs represent a formal risk management approach that allows organizations to maintain vendor support during transition periods beyond the standard End of Support date.