A compensating controls assessment asks how existing safeguards change the immediate risk of a vulnerability. It adds organizational context to severity scores so remediation priorities reflect exposure, not just technical severity. section 6.3.2
Compare exposure before assigning priority
A high-risk vulnerability on a system protected by network segmentation, strict access controls, and monitoring may pose less immediate risk than a moderate vulnerability on an exposed external-facing system. Assess the safeguards alongside exploit likelihood and business impact before deciding what to address first. section 6.3.2
