Associate compensating controls with CVEs or TPEs for risk reduction requests

task australia Updated Sep 10, 2026 2 min read sem-associate-controls-cve-risk-reduction.md

As a Vulnerability Manager or Analyst, you can associate relevant compensating controls with a Common Vulnerability Entry (CVE) or Third-party Entry (TPE) in the Security Exposure Management Workspace, which can be used for reducing the risk posed by a vulnerability.

Before you begin

Role required: sn_vul.vulnerability_analyst, or sn_vul.vulnerability_admin

About this task

If you don’t associate compensating controls to a CVE or TPE, all the active controls appear in the Select Compensating Controls field of the Request Exception form.
If you associate a compensating control to a CVE, this compensating control is automatically associated with the TPE, which is mapped to the CVE.

Note: The compensating controls feature is available for host vulnerabilities only.

Procedure

Navigate to Workspaces > Security Exposure Management Workspace.
On the Lists page, under Libraries, open one of the following for which you want to associate the controls:
- CVE from the CVEs list.
- TPE from the TPEs list.
Select Associate controls.

Note: The Associate controls button appears only when the risk reduction is enabled for a CVE or TPE. In other words, you can associate compensating controls only when risk reduction is enabled for a CVE or TPE. If the Associate controls button isn’t visible, select Enable risk reduction.
On the Associate controls modal, select the compensating controls that can be applied to vulnerabilities associated with the CVE or TPE for risk reduction.
Select Submit.
- The associated compensating controls appear in the Applicable compensating controls tab in the record view of the CVE and TPE.
- While a remediation owner requests risk reduction, these associated compensating controls appear in the Select Compensating Controls field on the Request Exception modal.

Restrict or enable risk change for a CVE or TPE

Add a compensating control to the library

Impact of the compensating controls on risk score and expiration date

58 lines · 3.9 KB Wrap lines

---
title: Associate compensating controls with CVEs or TPEs for risk reduction requests
description: As a Vulnerability Manager or Analyst, you can associate relevant compensating controls with a Common Vulnerability Entry \(CVE\) or Third-party Entry \(TPE\) in the Security Exposure Management Workspace, which can be used for reducing the risk posed by a vulnerability.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/sem-associate-controls-cve-risk-reduction.html
release: australia
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 2
breadcrumb: [Add a compensating control to the library, Use, Unified Security Exposure Management, Security Operations]
---

# Associate compensating controls with CVEs or TPEs for risk reduction requests

As a Vulnerability Manager or Analyst, you can associate relevant compensating controls with a Common Vulnerability Entry \(CVE\) or Third-party Entry \(TPE\) in the Security Exposure Management Workspace, which can be used for reducing the risk posed by a vulnerability.

## Before you begin

Role required: sn\_vul.vulnerability\_analyst, or sn\_vul.vulnerability\_admin

## About this task

- If you don’t associate compensating controls to a CVE or TPE, all the active controls appear in the [Select Compensating Controls](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/it-remediation-workspace/itr-ws-request-exception-form-rr.md) field of the Request Exception form.
- If you associate a compensating control to a CVE, this compensating control is automatically associated with the TPE, which is mapped to the CVE.

**Note:** The compensating controls feature is available for host vulnerabilities only.

## Procedure

1. Navigate to **Workspaces** &gt; **Security Exposure Management Workspace**.

2. On the Lists page, under Libraries, open one of the following for which you want to associate the controls:

- **CVE** from the CVEs list.
- **TPE** from the TPEs list.
3. Select **Associate controls**.

**Note:** The **Associate controls** button appears only when the risk reduction is enabled for a CVE or TPE. In other words, you can associate compensating controls only when risk reduction is enabled for a CVE or TPE. If the **Associate controls** button isn’t visible, select **Enable risk reduction**.

4. On the Associate controls modal, select the compensating controls that can be applied to vulnerabilities associated with the CVE or TPE for risk reduction.

5. Select **Submit**.

- The associated compensating controls appear in the Applicable compensating controls tab in the record view of the CVE and TPE.
- While a remediation owner requests risk reduction, these associated compensating controls appear in the [Select Compensating Controls](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/it-remediation-workspace/itr-ws-request-exception-form-rr.md) field on the Request Exception modal.

**Related topics**

[Understanding compensating controls for risk reduction](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-manager-workspace/compensating-controls-overview.md)

[Restrict or enable risk change for a CVE or TPE](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-manager-workspace/disable-risk-reduction.md)

[Add a compensating control to the library](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-manager-workspace/create-compensatory-control.md)

[Impact of the compensating controls on risk score and expiration date](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-manager-workspace/requesting-approving-risk-reduction.md)