Compensating Control

What Compensating Controls Really Do

Compensating controls are not a substitute for fixing the root cause. They are a temporary risk-reduction measure used when the ideal remediation, such as immediate patching or redesign, cannot happen yet. Their value is practical: they narrow exposure, reduce exploitability, and buy time, but they leave residual risk in place.

That distinction matters because a compensating control should be judged on whether it meaningfully lowers the specific risk that remains, not on whether it feels like a general security improvement. A control that is unrelated to the exposure, or that cannot be maintained reliably, is not a true compensating control in any useful sense.

Where Compensating Controls Fit in Security Operations

In real environments, compensating controls sit between discovery of a weakness and permanent remediation. They are common in legacy platforms, operational technology, end-of-life systems, and change-constrained environments where patching may be delayed by safety, uptime, compatibility, or vendor support constraints.

Typical examples include tighter access restriction, segmentation, stronger monitoring, session recording, isolation, or disabling nonessential functionality. The control should map to the actual failure mode, so if the exposure is remote exploitation, the compensating measure should reduce reachable attack surface or make unauthorized activity harder to execute.

Because the control is temporary, it should be tied to a specific exception or remediation window. That makes it part of disciplined risk management rather than an excuse to postpone fixing the underlying issue indefinitely.

Compensating Controls in Patch Exceptions and Legacy Systems

Compensating controls are most useful when patching is impossible, delayed, or operationally unsafe. In those cases, the control plan should be explicit about what is being reduced, for how long, and under what conditions the exception ends. NHIMG’s Virtual Patching and Compensating Controls Guide is a useful reference for understanding how virtual patching, isolation, and bypass testing support that role.

They also matter when organisations need a documented exception process. A compensating control is only credible if it is specific, testable, and time-bound, which is why exception governance and expiry are so closely linked to it. For that reason, NHIMG’s Remediation SLAs and Vulnerability Exceptions Guide and Vulnerability Risk Acceptance and Exception Template are practical complements to this concept.

In OT, the same idea often appears as segmentation, restricted maintenance access, and heightened monitoring while the site waits for a safer maintenance window. The measure is valuable precisely because it narrows exposure without pretending the vulnerable asset is no longer vulnerable.

What Makes a Compensating Control Effective

Effectiveness depends on fit, evidence, and durability. The control must address the same risk vector as the deferred fix, must be demonstrably working, and must remain effective for the full exception period. If it is easy to bypass, difficult to monitor, or dependent on manual discipline that cannot be sustained, it weakens quickly.

Good compensating controls also have a clear end state. They are meant to shrink risk while a permanent fix is planned, tested, and executed. NHIMG’s Security Control Types Guide helps place compensating controls in the wider control landscape, while Hardening Exceptions and Compensating Controls Template shows how organisations can record and expire deviations cleanly.

Where the compensating measure is technical, such as virtual patching or extra filtering, it should be tested for bypass and monitored for drift. Where it is procedural, such as restricted access or manual approval, it should be reviewed for consistency and evidence of use.

Risk and Threat Considerations

Compensating controls reduce exposure, but they also create a fragile security posture if they are treated as permanent or if they do not fully cover the underlying weakness. Attackers often look for exactly this kind of gap, a known vulnerability held in place by controls that may be incomplete, misconfigured, or easier to bypass than the original fix.

Failure mechanism: The control fails when the compensating measure does not actually block the attack path, is bypassed through an alternate route, or is left in place long after the exception should have expired.

Impact: Residual exposure remains, and the organisation may assume it has mitigated the issue when the vulnerable system is still reachable or exploitable.

Practitioner Guidance

Why practitioners should care: A compensating control is only useful if it measurably reduces the specific residual risk created by the delayed fix. Treat it as a governed interim measure, not as a permanent alternative to remediation.

What to watch for: Watch for controls that are broad, undocumented, or hard to verify, because those are the ones most likely to fail under real attack conditions. The strongest compensating controls are narrow, observable, and tied to a clear expiry or replacement plan.

Practitioner takeaway: If you cannot explain exactly what risk the control reduces, how you will validate it, and when it will be removed, it is probably just a workaround rather than a compensating control.

Related resources from NHI Mgmt Group

• When does compensating network control matter more than immediate patch deployment for critical systems?
• What breaks when a compensating control is deployed but never retested against the known exploit path?
• Who is accountable when teams deprioritise a vulnerability because a compensating control appears to reduce risk?
• What is the difference between patching an embedded OpenSSL dependency and using a compensating control while waiting for a fix?