Add a compensating control to the library

---
title: Add a compensating control to the library
description: As a Vulnerability Manager or Analyst, add a list of compensatory controls to the Compensating Controls library in the Vulnerability Manager Workspace, which can be applied for the risk reduction of host vulnerable items and remediation tasks.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/vulnerability-manager-workspace/create-compensatory-control.html
release: australia
product: Vulnerability Manager Workspace
classification: vulnerability-manager-workspace
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 2
breadcrumb: [Monitoring and managing vulnerable items and test results in the Vulnerability Manager Workspace, Vulnerability Manager Workspace, Vulnerability Response Workspaces, Unified Security Exposure Management, Security Operations]
---

# Add a compensating control to the library

As a Vulnerability Manager or Analyst, add a list of compensatory controls to the Compensating Controls library in the Vulnerability Manager Workspace, which can be applied for the risk reduction of host vulnerable items and remediation tasks.

## Before you begin

Role required: sn\_vul.vulnerability\_analyst, or sn\_vul.vulnerability\_admin

## About this task

Some commonly used compensating controls are shipped with the base system. You can view these compensating controls by navigating to **Workspaces** > **Vulnerability Manager Workspace** > **Lists** > **Libraries** > **Compensating controls**. You can activate or deactivate these compensating controls as per your requirement.

**Note:** The compensating controls feature is available for host vulnerabilities only.

## Procedure

1.  Navigate to **Workspaces** > **Vulnerability Manager Workspace**.

2.  On the List page under Libraries, select **Compensating Controls**.

3.  Click **New**.

4.  On the Create Compensating Controls form, fill in the fields.

    |Field|Description|
    |-----|-----------|
    |Name|Name of the compensating control, which appears as an option in the **Compensating controls** drop-down of the Request exception modal.|
    |Description|Brief information that provides details about the Compensating Control.|
    |Active|Status of the compensating control. Only active controls appear in the **Compensating controls** drop-down of the Request exception modal.|

5.  Select **Save**.

6.  On the Compensating Controls list under Libraries, select the desired compensating control and select **Edit**, activate or deactivate a compensating control and click **Save** to modify the compensating controls.

    All the active compensating controls appear as an option in the **Compensating controls** drop-down of the Request exception modal for risk reduction requests.


## What to do next

All active compensating controls in the library apply to every CVE and TPE by default. They are shown as options in the **Compensating controls** field of the Request Exception form for any risk reduction request.

-   **[Restrict or enable risk change for a CVE or TPE](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-manager-workspace/disable-risk-reduction.md)**  
As a Vulnerability Manager and Analyst, you can restrict or enable risk change for the host vulnerabilities associated with a Common Vulnerability Entry \(CVE\) or Third-party Entry \(TPE\) in the Vulnerability Manager Workspace.

**Parent Topic:**[Monitoring and managing vulnerable items and test results in the Vulnerability Manager Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-manager-workspace/using-vulnerability-manager-workspace.md)

**Related topics**  


[Understanding compensating controls for risk reduction](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-manager-workspace/compensating-controls-overview.md)

[Restrict or enable risk change for a CVE or TPE](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-manager-workspace/disable-risk-reduction.md)

[Impact of the compensating controls on risk score and expiration date](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-manager-workspace/requesting-approving-risk-reduction.md)