---
sourceDocument: Brazil Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/security-management

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Restrict or enable risk change for a CVE or TPE

# Restrict or enable risk change for a CVE or TPE {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
As a Vulnerability Manager and Analyst, you can restrict or enable risk change for the host vulnerabilities associated with a Common Vulnerability Entry (CVE)
or Third-party Entry (TPE) in the Vulnerability Manager Workspace.

## Before you begin

Role required: admin

## About this task

Risk change is enabled by default for a CVE and TPE.  
Note:  
The compensating controls feature is available for host vulnerabilities only.

## Procedure

1. Navigate to WorkspacesVulnerability Manager Workspace.  
   On the Lists page, under Libraries, open one of the following for which you want to restrict risk change:
   * CVE from the CVEs list.
   * TPEs from the TPEs list.
   {#disable-risk-reduction__ul_cgl_l4h_c1c}
2. Select Restrict risk change.  
   Risk change is restricted for the host vulnerable items related to this CVE or TPE. If other CVEs or TPEs in the same remediation task or Bulk Edit selection remain eligible, the remediation owner can still request risk change for those items. The Request Exception form and the Bulk Edit modal show how many of the selected items are eligible for risk change.
3. To enable risk change for host vulnerable items, select Enable risk change.
**Related concepts**   

* [Understanding compensating controls for risk reduction](https://www.servicenow.com/docs/2vKyos5JKfUYGn1SDMgAZA "Compensating controls are the measures taken to reduce the risk posed by vulnerabilities that can't be patched immediately. They can be used to mitigate the likelihood or impact of a successful exploit.")
* [Impact of the compensating controls on risk score and expiration date](https://www.servicenow.com/docs/PNbt0LYTyt1TDRNTE0F3xQ "As a Remediation Owner, you can request risk reduction for a host vulnerable item or remediation task. And the Vulnerability Manager or Analyst can approve these risk reduction requests.")  
**Related tasks**   

* [Add a compensating control to the library](https://www.servicenow.com/docs/L1aOtgbhBgTbZCoQJ6skzQ "As a Vulnerability Manager or Analyst, add a list of compensatory controls to the Compensating Controls library in the Vulnerability Manager Workspace, which can be applied for the risk reduction of host vulnerable items and remediation tasks.")

*[\>]: and then