A cloud service provider's FedRAMP-authorized system has an approved POA&M. During continuous monitoring, the provider discovers that a High-severity vulnerability remediation will miss its scheduled completion date by 45 days because a vendor patch is delayed. Which action BEST aligns with a compliance program that is operating as designed?

Remaining questions and full explanations are VIP-exclusive.