---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/pt-BR/security-management

 Release :

    - australia

ft:locale :

    - pt-BR

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Understanding compensating controls for risk reduction

# Understanding compensating controls for risk reduction {#ariaid-title1}

* Versão de lançamento: Australia
* 
* Atualizado 12 de mar. de 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 min. de leitura

Compensating controls are the measures taken to reduce the risk posed by vulnerabilities that can't be patched immediately. They can be used to mitigate the likelihood or impact of a successful exploit.  
Nota:  
The compensating controls feature is available for host vulnerabilities only.

Applying compensating controls can help in reducing the risk of a vulnerability.

The following table shows the use cases for compensating controls:
{#compensating-controls-overview__table_dbk_wfn_fzb__entry__2}

| Use case | Compensating control |
|-|-|
| A vulnerability in a web server that enables attackers to execute arbitrary code. | Implement a Web application firewall (WAF) to block malicious requests to the web server. |
| A vulnerability in an operating system that enables attackers to escalate privileges to root. | Implement an application control to restrict the execution of applications on the host system. |
| A vulnerability in a database server that enables attackers to access sensitive data. | Implement network segmentation to isolate the database server from other hosts and critical systems. |
[Tabela 1. Use cases for compensating controls]

{#compensating-controls-overview__table_dbk_wfn_fzb}

For more information on the impact of compensating controls on the risk score of a vulnerable item and remediation task, see [Impact of the compensating controls on risk score and expiration date](https://servicenow-prod.fluidtopics.net/zHEj6xccpSURiWVRaBZdTw "As a Remediation Owner, you can request risk reduction for a host vulnerable item or remediation task. And the Vulnerability Manager or Analyst can approve these risk reduction requests.").
**Tarefas relacionadas**   

* [Add a compensating control to the library](https://servicenow-prod.fluidtopics.net/_lMMgoL62Btnzmk60vfAhw "As a Vulnerability Manager or Analyst, add a list of compensatory controls to the Compensating Controls library in the Vulnerability Manager Workspace, which can be applied for the risk reduction of host vulnerable items and remediation tasks.")
* [Associate compensating controls with CVEs or TPEs for risk reduction requests](https://servicenow-prod.fluidtopics.net/XpThTv5D6d8aSCogfejHhQ "As a Vulnerability Manager or Analyst, you can associate relevant compensating controls with a Common Vulnerability Entry (CVE) or Third-party Entry (TPE) in the Vulnerability Manager Workspace, which can be used for reducing the risk posed by a vulnerability.")
* [Disable or enable risk reduction for a CVE or TPE](https://servicenow-prod.fluidtopics.net/1SOFpy7XIIuCesjkhJKI7w "As a Vulnerability Manager and Analyst, you can disable or enable the risk reduction requests for the host vulnerabilities associated with a Common Vulnerability Entry (CVE) or Third-party Entry (TPE) in the Vulnerability Manager Workspace.")