---
sourceDocument: Brazil Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/security-management

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Compensating controls overview

# Compensating controls overview {#ariaid-title1}

Release version: Brazil  
Updated May 11, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read  
A compensating control is an alternative safeguard that reduces the risk of a finding when the finding's standard remediation cannot be applied. Use compensating controls when the underlying vulnerability still exists but its risk is being managed through a different mitigation, instead of requesting an exception that defers remediation entirely.

## What is a compensating control {#sem-compensating-controls-overview__section_what_is_cc}

A compensating control is a mitigation that reduces the risk associated with a finding without removing the finding itself. Examples include:

* Network segmentation that limits exposure of a vulnerable host to untrusted networks.
* Application-layer access controls that restrict who can reach a vulnerable function.
* Monitoring and alerting rules that detect attempted exploitation of the vulnerable component.
* Endpoint detection-and-response policies that block known exploit signatures.

The finding remains in the system and continues to appear in vulnerability reports. The compensating control changes the residual risk, not the underlying vulnerability.

## When to use a compensating control instead of an exception {#sem-compensating-controls-overview__section_when_use_cc}

Choose a compensating control when all of the following are true:

* The standard remediation (patch, configuration change, code fix) cannot be applied in the near term.
* Another mitigation exists that demonstrably reduces the risk to an acceptable level.
* You can produce evidence that the mitigation is implemented and effective.

Choose an exception ([Defer a Remediation task](https://www.servicenow.com/docs/s~n7C018r2CxyrmFFcpSmw "If you identify a finding or remediation task for which a fix is not yet available and can be safely deferred without additional analysis, you can use the Request Exception feature.")) instead when there is no available mitigation and you are accepting the residual risk for a defined period.

Choose a false positive ([Request a false positive for a vulnerable item or remediate task](https://www.servicenow.com/docs/itv266TdVnKsfh50BpFggw "Indicate a false positive request for a finding or a remediation task in the Security Exposure Management Workspace. A false positive is a condition where a scanner incorrectly reports that a finding exists in the system due to situations such as an incorrect classification, improper logic, or an algorithm in the scanner.")) instead when the finding is incorrect --- the scanner reported a vulnerability that does not actually exist on the asset.

## Evidence requirements for a compensating control {#sem-compensating-controls-overview__section_evidence_cc}

The compensating-control approval flow requires evidence that the mitigation is in place and working. Acceptable evidence includes:

* Configuration snapshots from the compensating-control system (for example, firewall rule export, WAF policy ID).
* Test results showing that the mitigation blocks the relevant attack path.
* Monitoring rule definitions and the most recent triggering alerts.
* Architecture diagrams that show how the compensating control isolates the vulnerable asset.

Attach the evidence to the request when you submit it. Approvers reject requests that lack verifiable evidence.

## How compensating-control approvals work {#sem-compensating-controls-overview__section_approval_flow_cc}

Compensating-control requests follow the standard exception-management approval flow described in [Exception Management Overview](https://www.servicenow.com/docs/xZR8aXYl5UoRYP1um597hA "When your organization can't comply with a published finding or security policy, standard, or guideline, you can request an exception. Exception management entails requesting, reviewing, approving, or rejecting exceptions to a finding or remediation task (RT) that can’t be remediated."):

1. The remediation owner submits the request with the compensating-control description and evidence.
2. If the matching approval rule has a questionnaire configured, the owner completes the questionnaire before submission.
3. The request routes to the configured approver level or levels. Multi-level approval rules send the request through each level sequentially.
4. On approval, the finding transitions to Deferred with reason Mitigating control in place; the compensating-control evidence is preserved on the change approval record. On rejection or expiry, the finding reverts to its previous state.

The form fields used for compensating-control questionnaires are documented in [Questionnaire Configuration form fields](https://www.servicenow.com/docs/WmKoDEZeYRVc66vMDwYF4w "You can define distinct questionnaire for a distinct collection of vulnerabilities or remediation tasks by filtering the vulnerabilities or remediation tasks respectively.").

## Periodic review of approved compensating controls {#sem-compensating-controls-overview__section_review_cc}

A compensating control is not a permanent substitute for remediation. The approval includes an expiry date; before expiry, the requester must either:

* Complete the standard remediation and close the finding.
* Renew the compensating-control approval with updated evidence showing the mitigation is still in place and effective.

If neither action is taken before expiry, the finding reverts to Open and reappears in the assigned owner's queue.