---
sourceDocument: Australia Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Impact of the compensating controls on risk score and expiration date

# Impact of the compensating controls on risk score and expiration date {#ariaid-title1}

Release version: Australia  
Updated September 3, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 4 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Impact of the compensating controls on risk score and expiration date

This document explains how compensating controls affect the risk scores and expiration dates for vulnerable items and remediation tasks within ServiceNow Vulnerability Response.
Remediation Owners can request risk reductions, which Vulnerability Managers or Analysts approve.
Upon approval, risk scores are adjusted based on the desired risk rating, impacting ongoing risk management and SLA calculations.
Show full answer Show less  

## Impact on Risk Scores and Expiration Dates

* When a risk reduction request is approved, the risk score is lowered to the highest risk score associated with the approved Desired value.
* The **Original risk score** retains the scanner-calculated risk score prior to applying compensating controls.
* Expiration of compensating controls resets the risk score to its original higher value.

## Effect on Remediation Tasks and Associated Vulnerable Items

* Compensating controls approved on a remediation task automatically apply to all associated vulnerable items (except those Closed) with higher risk scores than the Desired value.
* Newly ingested vulnerable items linked to remediation tasks with approved compensating controls inherit the reduced risk rating and the original scanner risk is saved separately.
* SLAs for these new vulnerable items are calculated based on the reduced risk score, ensuring accurate prioritization.
* The **Until date for risk reduction** propagates to vulnerable items only if there was no previous compensating control; otherwise, existing expiration dates take precedence.

## Behavior for Individual Vulnerable Items

* Upon approval of risk reduction, the vulnerable item's Risk score is updated to the approved value, with the former score saved as Original risk score, effective until the expiration date.
* During ingestion, if the scanner's calculated risk is higher than the approved risk score, the risk score remains unchanged but the original risk score updates to the higher value; if lower, both scores update to the lower value.
* Changing the Configuration Item (CI) linked to a vulnerable item maintains compensating controls if system properties allow; otherwise, a new vulnerable item is created with the same compensating control and risk scores.
* Reopened vulnerable items with existing compensating controls retain those controls automatically.

## Practical Benefits for Customers

* Enables dynamic adjustment of risk scores to reflect compensating security measures, improving risk management accuracy.
* Ensures consistent application of compensating controls across remediation tasks and their vulnerable items, simplifying risk reduction processes.
* Preserves original risk data for audit and compliance purposes while providing updated risk insights for decision-making.
* Automates risk score inheritance and SLA calculations for new vulnerabilities linked to existing remediation tasks, saving manual effort.  
As a Remediation Owner, you can request risk reduction for a host vulnerable item or remediation task. And the Vulnerability Manager or Analyst can approve these risk reduction requests.

For more information on how to request risk reduction and approve risk reduction approval, see [Request a risk modification for a vulnerable item or remediation task](https://www.servicenow.com/docs/YMFrQBxshcQZEz5fyQt00w "Request a risk modification for a host vulnerable item or a remediation task in the IT Remediation Workspace.") and [Approve or reject requests in the Vulnerability Manager Workspace](https://www.servicenow.com/docs/JmHZsK9cXU4wNJPCJNMXvg "Approve or reject requests that are submitted by remediation owners.") respectively.

When a risk reduction request is approved, the risk score is reduced according to the Desired value (risk rating) in the state change approval (VCA#) record. The highest risk score of the desired risk
rating is assigned to the record when your risk reduction request is approved. The following example shows how the Risk score and Original risk score are updated when compensating controls are applied. The default highest risk
scores of the risk ratings are used in the following example.
{#requesting-approving-risk-reduction__table_st2_mzz_gzb__entry__4}

| Scenario | Risk rating | Risk score | Original risk score (Calculated risk score) |
|-|-|-|-|
| Data prior to v20.0 | 2 - High | 80 | The field is not available prior to v20.0. |
| After upgrading to v20.0 | 2 - High | 80 | Null |
| Calculated risk score changes to 90 during ingestion | 1 - Critical | 90 | Null |
| When you apply compensating controls | 3 - Medium | 69 | 90 |
| Calculated risk score changes to 70 during ingestion | 3 - Medium | 69 | 70 |
| Calculated risk score changes to 50 during ingestion | 3 - Medium | 50 | 50 |
| Calculated risk score changes to 80 during ingestion | 3 - Medium | 50 | 80 |
| When compensating controls expire on Until date for risk reduction | 2 - High | 80 | Null |
[Table 1. Impact of compensating controls on risk score and original risk score]

{#requesting-approving-risk-reduction__table_st2_mzz_gzb}

## Impact of compensating controls on a remediation task {#requesting-approving-risk-reduction__section_j2w_p3z_fzb}

When your request for risk reduction is approved for a remediation task, the impact of compensating controls on its vulnerable items is as follows:

* The compensating controls applied on the remediation task are applied on its vulnerable items (other than those in Closed state) that have risk score greater than the risk score corresponding to the Desired value in the state change approval of a remediation task. And the risk score of these vulnerable items is reduced according to the Desired value.
* When new vulnerable items are ingested and associated with a remediation task that already has an approved compensating control, the reduced risk rating is automatically inherited by the new vulnerable items. The risk score of the new vulnerable items is set to match the Desired value from the approved state change approval record, and the Original risk score field reflects the scanner-calculated value. This applies to all finding types across Vulnerability Response, Application Vulnerability Response, and Container Vulnerability Response.
* The SLA for newly ingested vulnerable items that inherit a compensating control from the remediation task is calculated based on the reduced risk level, not the original scanner-severity level.
* The Until date for risk reduction remains unchanged for the vulnerable items on which a compensating control is already applied. It is not updated with the Until date for risk reduction of the Remediation Task.
* The Until date for risk reduction is rolled down to the vulnerable items only when a compensatory control is not applied on any vulnerable item previously. If you apply the compensatory controls on the remediation task again, the Until date for risk reduction is not rolled down to the vulnerable items as the existing Until date for risk reduction of the vulnerable items is given priority.
* When a new vulnerable item is added to a remediation task on which compensatory controls are already applied, the compensating control is automatically applied to the new vulnerable item, and its risk score is reduced to match the Desired value from the approved state change approval record.
{#requesting-approving-risk-reduction__ul_hnp_5jp_bzb}

## Impact of a compensating control on a vulnerable item {#requesting-approving-risk-reduction__section_pq1_hkz_fzb}

When your request for risk reduction is approved for a vulnerable item:

* Its new risk score displays in the Risk score field and the old risk score (calculated risk score) moves to the Original risk score field. This change holds till the date specified in the Until date for risk reduction field.
* When a vulnerable item has compensating controls already applied, during ingestion:
  * If the calculated risk score is greater than the risk score then risk score remains same and original risk score is updated with the calculated risk score.
  * If the calculated risk score is less than the risk score then both risk score and original risk score are updated with the calculated risk score.
  {#requesting-approving-risk-reduction__ul_ikd_wb5_gzb}
* If a Configuration Item (CI) is changed for a vulnerable item on which a compensating control is already applied:
  * The CI is updated for a vulnerable item by default as the sn_sec_cmn.update_on_ci_change system property is set to true.

    The compensating control is still applicable for the vulnerable
    item.
  * The vulnerable item is closed and a new vulnerable item is created if the sn_sec_cmn.update_on_ci_change system property is set to false.

    The compensating control applied to the old
    vulnerable item is applied to the new vulnerable item and the Until date for risk reduction, Original risk score and Risk score remain the
    same.
  {#requesting-approving-risk-reduction__ul_stj_g1b_hzb}
* When a vulnerable item is reopened by the scanner and compensating control is already applied on it, the same compensating control is applied after it is reopened.
{#requesting-approving-risk-reduction__ul_zxv_kb5_gzb}
**Related concepts**   

* [Understanding compensating controls for risk reduction](https://www.servicenow.com/docs/lfL1ilZ~cS~h1vU8BMI49g "Compensating controls are the measures taken to reduce the risk posed by vulnerabilities that can't be patched immediately. They can be used to mitigate the likelihood or impact of a successful exploit.")  
**Related tasks**   

* [Add a compensating control to the library](https://www.servicenow.com/docs/CnRYfdkCzjQjmVMVX77y8A "As a Vulnerability Manager or Analyst, add a list of compensatory controls to the Compensating Controls library in the Vulnerability Manager Workspace, which can be applied for the risk reduction of host vulnerable items and remediation tasks.")
* [Restrict or enable risk change for a CVE or TPE](https://www.servicenow.com/docs/PkBpor8ePECeKOr89863KA "As a Vulnerability Manager and Analyst, you can restrict or enable risk change for the host vulnerabilities associated with a Common Vulnerability Entry (CVE) or Third-party Entry (TPE) in the Vulnerability Manager Workspace.")  
**Related topics**   

* [../../vulnerability-response/concept/vr-ws-exceptions-split-VMGR-ws.html#vr-ws-exceptions-split-VMGR-ws__li-risk-reduction-vmws](https://www.servicenow.com/docs/bWo4zdNcYMgNqM8grmyNNw#vr-ws-exceptions-split-VMGR-ws__li-risk-reduction-vmws)