---
sourceDocument: Australia Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Add a compensating control to the library

# Add a compensating control to the library {#ariaid-title1}

Release version: Australia  
Updated September 3, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
As a Vulnerability Manager or Analyst, add a list of compensatory controls to the Compensating Controls library in the Vulnerability Manager Workspace, which can be applied for the risk reduction of host vulnerable items and remediation tasks.

## Before you begin

Role required: sn_vul.vulnerability_analyst, or sn_vul.vulnerability_admin

## About this task

Some commonly used compensating controls are shipped with the base system. You can view these compensating controls by navigating to WorkspacesVulnerability Manager WorkspaceListsLibrariesCompensating controls. You can activate or deactivate these compensating controls as per your requirement.  
Note:  
The compensating controls feature is available for host vulnerabilities only.

## Procedure

1. Navigate to WorkspacesVulnerability Manager Workspace.
2. On the List page under Libraries, select Compensating Controls.
3. Click New.
4. On the Create Compensating Controls form, fill in the fields.  
   {#create-compensatory-control__table_tvw_5qw_1zb__entry__2}

   | Field | Description |
   |-|-|
   | Name | Name of the compensating control, which appears as an option in the Compensating controls drop-down of the Request exception modal. |
   | Description | Brief information that provides details about the Compensating Control. |
   | Active | Status of the compensating control. Only active controls appear in the Compensating controls drop-down of the Request exception modal. |
   [Table 1. Create Compensating Controls form fields]

   {#create-compensatory-control__table_tvw_5qw_1zb}
5. Select Save.
6. On the Compensating Controls list under Libraries, select the desired compensating control and select Edit, activate or deactivate a compensating control and click Save to modify the compensating controls.  
   All the active compensating controls appear as an option in the Compensating controls drop-down of the Request exception modal for risk reduction requests.

## What to do next

All active compensating controls in the library apply to every CVE and TPE by default. They are shown as options in the
Compensating controls field of the Request Exception form for any risk reduction request.
* **[Restrict or enable risk change for a CVE or TPE](https://www.servicenow.com/docs/PkBpor8ePECeKOr89863KA)**   
  As a Vulnerability Manager and Analyst, you can restrict or enable risk change for the host vulnerabilities associated with a Common Vulnerability Entry (CVE) or Third-party Entry (TPE) in the Vulnerability Manager Workspace.

**Related concepts**   

* [Understanding compensating controls for risk reduction](https://www.servicenow.com/docs/lfL1ilZ~cS~h1vU8BMI49g "Compensating controls are the measures taken to reduce the risk posed by vulnerabilities that can't be patched immediately. They can be used to mitigate the likelihood or impact of a successful exploit.")
* [Impact of the compensating controls on risk score and expiration date](https://www.servicenow.com/docs/bTr0bwJDUG1RCOsW1oW0zA "As a Remediation Owner, you can request risk reduction for a host vulnerable item or remediation task. And the Vulnerability Manager or Analyst can approve these risk reduction requests.")  
**Related tasks**   

* [Restrict or enable risk change for a CVE or TPE](https://www.servicenow.com/docs/PkBpor8ePECeKOr89863KA "As a Vulnerability Manager and Analyst, you can restrict or enable risk change for the host vulnerabilities associated with a Common Vulnerability Entry (CVE) or Third-party Entry (TPE) in the Vulnerability Manager Workspace.")

*[\>]: and then