What they are for
Temporary compensating controls help teams reduce practical risk when a direct code, cloud, or runtime remediation cannot ship immediately.
What gets tracked
Each control records owner, rationale, approval state, orchestration reference, and a TTL so the exception window stays explicit and reviewable.
How review works
Expired controls move into review-required state and surface through the alerts workflow so teams can extend, replace, or revoke them.
Recommended operator flow
1. Pick the least disruptive control
Use WAF rules for exposed application paths, EDR isolation for host/runtime risk, segmentation for reachability reduction, and policy hardening when access or configuration can be tightened temporarily.
2. Keep the exception window short
Every temporary control should have a named owner, a clear reason, and a bounded TTL that matches the expected remediation timeline.
3. Review before expiry becomes drift
Treat expired temporary controls as governance work, not background noise. Extend only with a fresh rationale or revoke them once permanent remediation is complete.
Control types included
- WAF virtual patching for exposed app paths
- EDR containment or isolation for host/runtime findings
- Network segmentation for reachability reduction
- Temporary policy hardening for risky permissions or configuration