Compensating control
A control used instead of one that a standard or policy requires but that cannot be met, which must address the same risk to at least the same degree. It needs evidence that it works and a date to revisit it.
Covered in
Approve, expire and measure security exceptions without hiding risk
Keep temporary acceptance separate from remediation and measure outcomes using definitions that survive changing visibility.
Prioritize vulnerabilities by exploitation, exposure and impact
Rank vulnerabilities with CISA KEV, EPSS, CVSS 4.0 vectors and SSVC decision points, adjust for presence, reachability and asset value, and turn the result into due dates. Covers NVD's 2026 enrichment changes and CISA BOD 26-04.
Harden the images you ship against CIS, STIG and SCAP benchmarks
Hold each image your team ships (container base images, golden VM images, Kubernetes node images) to a published benchmark through a pinned SCAP Security Guide profile, scan every build with OpenSCAP, and fail the build on any failure that a deviation register does not explain with an owner, an approver and an expiry.
Practice: Local project: Gate an image build on a CIS scan and a deviation register