Authorization

Mitigating Control

A Mitigating Control is an alternative control used to reduce risk when a direct access conflict or policy exception cannot be fully removed.

Synonym
Compensating Control

Definition

A Mitigating Control is a compensating mechanism introduced when risky access, policy conflicts, or separation issues cannot be eliminated immediately. It may involve additional review, logging, managerial oversight, time limits, or operational constraints designed to reduce residual risk.

Why it matters

Mitigating Controls allow organizations to manage residual risk when ideal access configurations are not immediately achievable.

The Ariovis perspective

Exceptional access should be explicit, approved, time-bound and reviewed. It should not become permanent simply because the original request was never revisited.

Common pitfalls

  • A common pitfall is treating mitigating controls as permanent rather than as temporary measures pending proper remediation.

These concepts matter most inside a real project.

The first conversation helps establish your context, the systems involved and the next useful decision.