I have an internal legacy application (ERP) that houses our core customer/order information. There is no way to justify the migration to a new platform. So, understanding that this system only have FCI, not CUI... what are your thoughts on compensating controls to operate this system within CMMC L1? I am blocking internet access from the system, removing connections that are from outside scope, hardening the systems as much as possible. But, at the end of the day, they are old and not patched. The hardware environment is patched and compliant. It's only the virtual machines that are old.