Glossary
Compensating control
A safeguard that reduces the likelihood or impact of exploiting a vulnerability that cannot be removed right away.
A compensating control is an alternative measure that reduces risk when the primary control — usually applying a fix — is not possible in time. Typical examples are isolating the vulnerable system on a restricted network segment, disabling the vulnerable feature, filtering exploit traffic with a WAF or IPS rule, requiring VPN and MFA to reach a management interface, and adding targeted detection in the SOC.
To be meaningful, a compensating control must address the specific attack path of the vulnerability, not general security hygiene, and it should be verifiable: a firewall rule can be inspected and a disabled service can be scanned.
In a VOC, compensating controls are a mandatory part of any exception or risk acceptance, and they often count as the "mitigation" step in emergency SLAs. See exceptions and risk acceptance.