Does your organization consistently apply the established criteria for selecting compensating controls when vulnerabilities cannot be immediately remediated?

When vulnerabilities are identified but cannot be immediately patched or fixed, organizations need a systematic approach for implementing alternative controls that reduce the risk to acceptable levels. These compensating controls might include network segmentation, enhanced monitoring, or access restrictions that make the vulnerability more difficult to exploit while a permanent fix is developed.

Evidence could include documentation of the criteria used for selecting compensating controls, examples of risk assessments showing the application of these criteria, and records of implemented compensating controls with justification for their selection based on the established criteria.