---
title: Associate compensating controls with CVEs or TPEs for risk reduction requests
description: As a Vulnerability Manager or Analyst, you can associate relevant compensating controls with a Common Vulnerability Entry \(CVE\) or Third-party Entry \(TPE\) in the Security Exposure Management Workspace, which can be used for reducing the risk posed by a vulnerability.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/sem-associate-controls-cve-risk-reduction.html
release: australia
topic_type: task
last_updated: "2026-03-12"
reading_time_minutes: 2
breadcrumb: [Add a compensating control to the library, Use, Unified Security Exposure Management, Security Operations]
---

# Associate compensating controls with CVEs or TPEs for risk reduction requests

As a Vulnerability Manager or Analyst, you can associate relevant compensating controls with a Common Vulnerability Entry \(CVE\) or Third-party Entry \(TPE\) in the Security Exposure Management Workspace, which can be used for reducing the risk posed by a vulnerability.

## Before you begin

Role required: sn\_vul.vulnerability\_analyst, or sn\_vul.vulnerability\_admin

## About this task

-   If you don’t associate compensating controls to a CVE or TPE, all the active controls appear in the [Select Compensating Controls](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/it-remediation-workspace/itr-ws-request-exception-form-rr.md) field of the Request Exception form.
-   If you associate a compensating control to a CVE, this compensating control is automatically associated with the TPE, which is mapped to the CVE.

**Note:** The compensating controls feature is available for host vulnerabilities only.

## Procedure

1.  Navigate to **Workspaces** > **Security Exposure Management Workspace**.

2.  On the Lists page, under Libraries, open one of the following for which you want to associate the controls:

    -   **CVE** from the CVEs list.
    -   **TPE** from the TPEs list.
3.  Select **Associate controls**.

    **Note:** The **Associate controls** button appears only when the risk reduction is enabled for a CVE or TPE. In other words, you can associate compensating controls only when risk reduction is enabled for a CVE or TPE. If the **Associate controls** button isn’t visible, select **Enable risk reduction**.

4.  On the Associate controls modal, select the compensating controls that can be applied to vulnerabilities associated with the CVE or TPE for risk reduction.

5.  Select **Submit**.

    -   The associated compensating controls appear in the Applicable compensating controls tab in the record view of the CVE and TPE.
    -   While a remediation owner requests risk reduction, these associated compensating controls appear in the [Select Compensating Controls](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/it-remediation-workspace/itr-ws-request-exception-form-rr.md) field on the Request Exception modal.

**Parent Topic:**[Add a compensating control to the library](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/sem-create-compensatory-control.md)

**Related topics**  


[Understanding compensating controls for risk reduction](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-manager-workspace/compensating-controls-overview.md)

[Restrict or enable risk change for a CVE or TPE](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-manager-workspace/disable-risk-reduction.md)

[Add a compensating control to the library](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-manager-workspace/create-compensatory-control.md)

[Impact of the compensating controls on risk score and expiration date](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-manager-workspace/requesting-approving-risk-reduction.md)