When a departmental system continues to be out of compliance with an information security policy's password strength requirements, the BEST action to undertake is to:

submit the issue to the steering committee. 

conduct an impact analysis to quantify the risks. 

isolate the system from the rest of the network. 

request a risk acceptance from senior management.