How do security teams decide when to use compensating controls instead of replacement?

When a compensating control is better than waiting for replacement

Security teams usually choose a compensating control when the original control gap cannot be fixed fast enough, but the asset still has to keep operating. The decision is rarely about liking the workaround, it is about preserving service while reducing exposure enough to buy time for a proper remediation.

A compensating control should be tied to a specific gap, a specific risk, and a specific expiry condition. If it does not measurably reduce the exposure introduced by the missing or weak control, it is just a delay tactic, not a defensible substitute.

How teams judge whether the control is truly compensating

The key test is whether the alternative control is strong enough to address the same risk outcome, even if it works differently. That means the team should be able to explain what failure mode is being contained, what trust is being reduced, and why replacement cannot happen yet without unacceptable disruption.

For access and segregation issues, the workaround needs to reduce the chance of misuse, fraud, or unintended privilege in the same way the broken control would have done. NHIMG’s Segregation of Duties (SoD) Guide is useful here because it frames compensating controls as a mitigation for conflicting access, not as a permanent excuse to keep toxic combinations in place.

That judgement also depends on whether the workaround is observable and reviewable. A compensating control that cannot be monitored, tested, or revoked on schedule becomes a hidden dependency, which is usually where teams get surprised later.

When replacement is still the right answer

Replacement remains the preferred path whenever the asset can tolerate change, downtime, or revalidation without creating a larger operational problem than the risk being mitigated. If the workaround has started to look permanent, or if it requires repeated manual oversight to remain safe, the team should treat that as a sign that the real control has been deferred too long.

Good teams separate “temporary containment” from “acceptable steady state.” The first may be justified by business continuity, but the second usually means the organisation has normalised an exception that should have been retired.

That distinction matters because compensating controls often shift risk rather than eliminate it. They may reduce blast radius, but they can also add complexity, manual approval paths, and audit burden, all of which create their own failure modes if nobody owns the follow-up replacement work.

Risk and Threat Considerations

Compensating controls are risky when they become the long-term answer for a weakness that was originally supposed to be removed. The danger is not only residual exposure, but also control drift, where the workaround gradually loses scrutiny while attackers, insiders, or operational exceptions continue to rely on it.

Failure mechanism: The team treats a temporary containment measure as if it were equivalent to the original control, so the underlying weakness stays in place while monitoring, ownership, or expiry discipline weakens.

Impact: The asset keeps running, but the organisation carries persistent exposure, harder audit evidence, and a larger chance that the workaround fails under pressure or is bypassed during an incident.

Practitioner Guidance

Decision rule: Use a compensating control only when the business impact of replacement is higher than the residual risk of containment, and set an explicit expiry or review point at the same time.

What to verify: Confirm that the workaround actually closes the specific gap, has an owner, and can be removed when the original control is restored. If you cannot show those three things, the control is probably an exception, not a substitute.

What to measure: Track how long the compensating control has been active, how often it is reviewed, and whether the underlying remediation has a committed delivery path. Long duration without movement is the clearest sign that temporary has become permanent.

Practitioner takeaway: The best compensating control is the one that safely preserves service while creating pressure to finish the replacement, not the one that makes the exception easiest to live with.

Related resources from NHI Mgmt Group

• How do security teams decide when to use DLP controls instead of manual review for Google Drive downloads?
• How should security teams use IAST and RASP in NHI governance?
• When should security teams use kernel-level controls instead of eBPF for workload identity?
• How do security teams decide whether to use validation or retrieval controls first?