---
sourceDocument: Zurich Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/security-management

 Release :

    - zurich

ft:locale :

    - en-US

ft:publication_title :

    - Zurich Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Request a risk modification for a vulnerable item or remediation task

# Request a risk modification for a vulnerable item or remediation task {#ariaid-title1}

Release version: Zurich  
Updated September 3, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read  
Request a risk modification for a host vulnerable item or a remediation task in the IT Remediation Workspace.

## Before you begin

Role required: sn_vul.remediation_owner

## About this task

Starting from v21.0 of Vulnerability Response, you can request risk reduction only for the following items:

* A remediation task only if all its vulnerable items are associated to the same Common Vulnerability Entry (CVE) regardless of whether its risk reduction is enabled for CVEs.
* A third-party (TPE) for which risk reduction is enabled.

{#request-risk-reduction__ul_zlw_1p4_21c}  
Note:  
The compensating controls feature is available for host vulnerabilities only.

A remediation task can include vulnerable items associated with more than one CVE or TPE. If risk change is restricted for some of those CVEs or TPEs, you can still request risk reduction for the
eligible vulnerable items. The Request risk modification form shows how many of the selected items are eligible for risk change. If none of the selected items are eligible, the form states that
risk change is restricted and the request can't proceed.

## Procedure

1. Navigate to WorkspacesIT Remediation Workspace.
2. Select the List icon (![List icon]()).
3. On the List page, open a host vulnerable item or a remediation task.
4. Select the More options icon and select Request risk modification.
5. On the Request risk modification form, fill in the fields.  
   For a description of the field values, see [Modify risk and Request risk modification form fields](https://www.servicenow.com/docs/wdc2KL9rkhlez7qLC_n2sw "The following table shows the fields on the Modify risk and Request risk modification dialogs.").
6. Select Submit request.  
   Note:  
   No questionnaire is required, even if a questionnaire is configured for exception requests. If you previously relied on a questionnaire configured for exception requests on the Mitigating Control in Place reason to gather this information for risk modification, that questionnaire no longer appears for new risk modification requests. In case you must modify your questionnaire, refer to KB2713229.

## Result

A message appears stating that your request is successfully submitted for approval. A notification is sent to the approver about your request. A state change approval (VCA#) record is created.
The state of the record doesn't change until the request is approved.

On approval or rejection of your request, you'll receive a notification. For more information on the approval process, see [Approve or reject requests in the Vulnerability Manager Workspace](https://www.servicenow.com/docs/HTxH6Mc~xWADgatLF7Jq9g "Approve or reject requests that are submitted by remediation owners.").

For more information on how the Until date for risk reduction is updated for a remediation task and vulnerable item when a risk reduction request is approved, see [Impact of the compensating controls on risk score and expiration date](https://www.servicenow.com/docs/kvchkrutggx3Vwl52vO4TQ "As a Remediation Owner, you can request risk reduction for a host vulnerable item or remediation task. And the Vulnerability Manager or Analyst can approve these risk reduction requests.").
**Related concepts**   

* [Understanding compensating controls for risk reduction](https://www.servicenow.com/docs/y51JfXKw~ptBSjGp66T7HQ "Compensating controls are the measures taken to reduce the risk posed by vulnerabilities that can't be patched immediately. They can be used to mitigate the likelihood or impact of a successful exploit.")
* [Impact of the compensating controls on risk score and expiration date](https://www.servicenow.com/docs/kvchkrutggx3Vwl52vO4TQ "As a Remediation Owner, you can request risk reduction for a host vulnerable item or remediation task. And the Vulnerability Manager or Analyst can approve these risk reduction requests.")  
**Related tasks**   

* [Restrict or enable risk change for a CVE or TPE](https://www.servicenow.com/docs/Wwedd2EZUxzzL~e8LLvshw "As a Vulnerability Manager and Analyst, you can restrict or enable risk change for the host vulnerabilities associated with a Common Vulnerability Entry (CVE) or Third-party Entry (TPE) in the Vulnerability Manager Workspace.")
* [Add a compensating control to the library](https://www.servicenow.com/docs/Xe0xnhFswV_MyoBPxfFeiQ "As a Vulnerability Manager or Analyst, add a list of compensatory controls to the Compensating Controls library in the Vulnerability Manager Workspace, which can be applied for the risk reduction of host vulnerable items and remediation tasks.")

*[\>]: and then