A compensating control is a safeguard that reduces the risk of a vulnerability you cannot fix immediately. It does not remove the flaw. To count in prioritization it must target the specific attack, be verified as working, and carry an expiry date and an owner.
Definition in plain terms
Suppose a flaw cannot be patched this week because of a vendor delay or a risky change window. A compensating control is something else you do that makes the flaw harder to exploit or limits what an attacker gets. The flaw remains. The risk is lower for a while.
CVSS v4.0 recognizes controls in its Environmental group, describing consideration of the presence of security controls which may mitigate some or all consequences of a successful attack. The words may mitigate matter, because mitigation has to be demonstrated, not assumed.
Examples
| Control | What it can do | What it cannot do |
|---|---|---|
| Network restriction to a small set of clients | Cuts who can reach the service | Stop an attacker who is already one of those clients |
| Disabling a vulnerable feature | Removes the attack path | Help if other features share the flaw |
| Blocking rule at a gateway | Stops known exploit patterns | Stop novel payloads |
| Extra authentication in front | Raises the bar | Help once credentials are stolen |
| Increased monitoring and alerting | Shortens detection time | Prevent the attack |
| Removing sensitive data from the system | Lowers impact | Prevent access to the system |
What does not count
- A control that exists on paper but has never been tested.
- A general security practice, such as having a firewall, with no link to this flaw.
- A promise to patch later.
- A control that sits in detection mode when the claim is prevention.
- A control owned by a team that does not know it is being relied upon.
The four test
Before you let a control lower priority, ask:
- Specific: does it address this attack path?
- Verified: do you have evidence from a test, with a date?
- Owned: is someone responsible for keeping it in place?
- Time limited: when does the claim expire?
If any answer is no, the control does not lower priority.
Fit with the rest of triage
Compensating controls fit after exploit evidence and reachability. If a flaw is on a list of known exploited vulnerabilities, such as CISA's Known Exploited Vulnerabilities Catalog, controls can help bridge the time until a fix, but they should not be the long term answer. The catalog sets due dates for each entry, and those dates show how fast the expected response is.
Record format
Keep the record short:
- Finding and asset
- Control, owner and evidence date
- What the control prevents and what it does not
- Expiry and fix plan
Retiring the control
When the fix ships, remove the exception and note the date. A compensating control that stays on the record after the fix is clutter, and clutter makes real exceptions harder to find.
Quick check
Is a compensating control the same as a mitigation?
The terms overlap. A compensating control usually means a substitute for the fix that you can document for review.
How long should an exception last?
Short enough that someone must look again. Pick a period your teams can meet and renew only with fresh evidence.
Sources
Last reviewed: 19 October 2026.
