Aged Compensating Control Half-Life: When Substitutes Expire
A compensating control is only as defensible as the evidence that it still performs the substitution. The register passes the audit at approval, the framework citation is filed, the residual risk position is recorded, and the substitute mechanism is in place. Twelve months later, the configuration has shifted, the bound owner has departed, the upstream primary control has been re-scoped, or the test evidence is older than the re-validation cadence. The compensating control still appears in the register, but the substitution claim is no longer supported by a current artefact. Programmes that read compensating controls as a static field set at approval under-count the exposure; programmes that read them as a query against the live record surface aging before it becomes an audit finding or a leadership-review surprise.1,2,4,5,7
This research covers how compensating controls actually age across enterprise security and compliance programmes. It names the six canonical aging events (configuration drift on the substitute mechanism, ownership departure of the bound operator, upstream scope change on the primary control, severity revision on the underlying vulnerability, re-validation evidence aging past the cadence window, framework citation update), the three primary measurement axes (currency rate, aging-event rate, re-validation latency), the failure modes that hide aging from the register query, the four substitution classes (configuration, architecture, process, monitoring) and their distinct half-life shapes, the framework citations that expect substitutes to remain current (PCI DSS v4.0 Appendix B and 12.3.4, ISO 27001:2022 A.5.7 and A.5.37, NIST SP 800-53 CA-5 and PM-9, NIST CSF 2.0 GV.RR, SOC 2 CC3.2, CIS Controls v8.1, HITRUST CSF), and the live-record discipline that keeps the substitute layer defensible across audit cycles.3,6,8,9,10,12
Why compensating controls age differently from primary controls
A primary control is the mechanism the framework, requirement, or design baseline names as the expected implementation for a control objective. The audit reads the primary control against the operating configuration, the change record, and the evidence of effectiveness. A compensating control is a documented substitute approved when the primary control cannot be implemented, is not cost-effective, or conflicts with the operating environment. The audit reads the substitute in place of the primary control, with the additional expectation that the substitute meets the intent and rigour of the original requirement and provides a similar level of defence.1,4,7
Because the substitute is approved against the conditions of approval, the audit-week query reads the substitute against current conditions. The conditions shift: the operating configuration drifts on a release cadence, the bound owner moves teams or leaves, the upstream primary control changes scope, the underlying vulnerability changes severity through a new exploit signal, the framework clause is updated or interpreted more strictly. The substitute that worked against the conditions at approval may no longer perform the substitution against the conditions at audit. The compensating control register entry stays in place; the supporting artefact ages.
This is why compensating controls require their own re-validation cadence. Primary controls age too, but the framework expects them to be continuously monitored, change-controlled, and tied to the operating configuration of record. Compensating controls carry an additional discipline because they substitute for the framework expectation rather than meet it directly. Programmes that treat compensating controls as a one-time approval rather than as a recurring re-validation accumulate a half-life tail that the audit reads at the next assessment.2,5,7
The six canonical aging events
Compensating control aging does not arrive in one shape. Six canonical events drive the bulk of aging across enterprise programmes. Each event has its own detection signature, its own organisational cadence, and its own re-validation pattern. The aging register names the event class on each affected substitute so the audit citation for re-validation reads as a closed loop rather than as an inferred manual sweep.1,2,4,6
| Aging event | Detection signature | Re-validation pattern |
|---|---|---|
| Configuration drift on the substitute | Change record on a configuration item bearing a compensating control reference; modified WAF rule, weakened access policy, disabled monitoring rule, or relaxed segmentation policy. | Re-test the substitute against the original substitution claim; update the test evidence; record the operating configuration that supports the substitute. |
| Ownership departure of the bound operator | Bound owner is inactive in the workspace user record; HR offboarding event for the bound owner identity; no successor recorded. | Successor binding from the team or function record; documented handover of the substitute operation and the re-validation cadence. |
| Upstream scope change on the primary control | The primary control the substitute compensates for is re-scoped, retired, merged into a different control area, or replaced by a different primary mechanism. | Re-validate that the substitution relationship is still well-defined; re-record the framework citation against the updated primary control. |
| Severity revision on the underlying vulnerability | New CVSS revision, new exploit signal, new CISA KEV listing, or new EPSS escalation that raises the severity above the substitution coverage. | Re-evaluate whether the substitute still provides a similar level of defence at the new severity band; escalate to remediation if the substitute no longer meets the bar. |
| Re-validation evidence aging past the cadence window | The documented test that confirmed the substitute works is older than the re-validation cadence and has not been refreshed; effectiveness rating drifts downward. | Re-run the test; refresh the captured artefact; update the effectiveness rating; record the re-validation event in the activity log. |
| Framework citation update | The framework clause that justified the substitution is updated, narrowed, or interpreted more strictly by the assessor through guidance or a published clarification. | Re-justify the substitution against the updated framework wording; re-confirm that the substitute meets the intent and rigour of the current clause. |
The pattern across the table is that detection requires a versioned configuration record (so drift events surface as change records), a versioned user record (so departures surface as inactivity), a versioned control catalogue (so primary-control scope change surfaces as a structural event), a versioned severity catalogue (so vulnerability re-scoring surfaces as a finding update), a versioned evidence register with cadence windows (so evidence aging surfaces as a query), and a versioned framework citation register (so framework updates surface as a citation-side change). Programmes that run any of these as static spreadsheets cannot detect the aging event automatically and run the re-validation sweep as a manual audit-week reconciliation.
The three primary measurement axes
Aging is measurable as a function of the live record across three axes that together separate a programme with a durable substitute layer from one that runs compensating control hygiene as an audit-week sprint.5,6,17
Compensating control currency rate
The fraction of recorded compensating controls whose re-validation evidence is within the cadence window, whose bound owner is active in the workspace user record, and whose substitution relationship is well-defined against the current primary control. Calculated at query time against the live record so the audit-week answer and the operational answer are the same number. A programme that holds ninety-five percent currency continuously runs the substitute layer as a living artefact; a programme that hits ninety-five percent only during the audit-week reconciliation runs the substitute layer as a derivative report.
Aging-event rate inside the quarter
The fraction of recorded compensating controls that experienced one of the six canonical aging events since the last re-validation, observed across a quarterly window. Decomposes by event class so the programme can read which aging path drives most of the rate (configuration drift, ownership departure, primary-control scope change, severity revision, evidence aging, framework update). Programmes whose aging rate concentrates in configuration drift need a change-management process that flags compensating-control-bearing items; programmes whose aging rate concentrates in evidence aging need a tighter re-validation cadence or a different evidence artefact pattern.
Re-validation latency
The median elapsed time between a detected aging event and the recorded re-validation event for compensating controls affected by that event. Reads the discipline of the re-validation sweep against the rate of new aging events. A latency in the single-digit days indicates an event-triggered sweep on cadence; a latency in the tens of days indicates a periodic sweep that lags aging; a latency in the hundreds of days indicates a sweep that only runs at audit week and absorbs the accumulated aging tail as one capture event.
Reporting these three together separates the false-passing programmes (high currency rate at audit week only, achieved through a manual sweep) from the durable programmes (high currency rate at any time, achieved through a continuous re-validation layer). The trio also separates the failure modes: currency-rate erosion with low aging rate points at re-validation latency; high aging rate with high currency rate points at a fast re-validation sweep handling a noisy substrate; high aging rate with low currency rate points at both a noisy substrate and a lagging sweep.
Six failure modes that hide aging from the register query
Aging tends to be invisible to the compensating control register query because the register field is populated. The aging surfaces only when the audit-week query, the framework reassessment, or the exception renewal routine tries to act on the substitute. Six failure modes hide the aging until the action moment, when the failure is operationally and financially expensive.1,2,4,7,9
Static substitute snapshot at approval
The substitute description is recorded at approval and never re-resolved against the operating configuration. The register query returns the snapshot; the snapshot does not age with configuration drift; the audit-week query verifies the operating configuration and fails on a measurable fraction. The discipline is to bind the compensating control to a versioned configuration record and to re-resolve the substitute against the current configuration on the re-validation cadence.
Effectiveness rating set once and never refreshed
The substitute is recorded with a Demonstrated rating at approval and the rating is never re-evaluated against fresh test evidence. The register reads Demonstrated; the underlying evidence is older than the cadence window; the audit-week query reads the evidence age and downgrades the rating from Demonstrated to Likely or Unverified. The discipline is to tie the rating to the evidence age through the re-validation cadence so the rating ages downward automatically rather than holding constant against a snapshot decision.
No bound owner of record
The compensating control is recorded against an organisational function (security-engineering, cloud-platform-team, GRC-team) rather than against a named individual with a documented secondary. The register field always resolves to a valid group; the operational query for who is responsible for the next re-validation cannot answer. The discipline is to bind the substitute to a named primary owner with a documented secondary, even when the operational hand-off uses a group inbox for notification.
Framework citation pointing at a superseded clause
The substitute references a framework clause that has been updated, renumbered, or interpreted more strictly in a published clarification. The register field still reads the original clause; the audit-week query reads the current clause and the substitution rationale no longer maps cleanly. The discipline is to track framework updates as events against the citation register and to re-justify substitutes whose cited clause has changed.
Primary-control scope change without substitute re-check
The primary control the substitute compensates for is re-scoped, retired, or merged into a different control area. The substitute register still references the original primary control by name; the substitution relationship is no longer well-defined against the current control catalogue. The discipline is to treat primary-control changes as triggers for a re-check of every dependent substitute, not as routine catalogue updates.
Exception register and substitute register diverging
An active vulnerability exception references a compensating control by name; the substitute is tracked on its own register; the two registers are joined by a free-text reference rather than by a stable identifier. As either register changes (an exception renews, a substitute is retired or replaced), the join can drift and the exception can reference a substitute that is no longer operational. The discipline is to use stable identifiers across both registers and to query the join as a routine operational read rather than as an audit-week reconciliation.
Half-life shapes by substitution class
Half-life behaves differently across the four common substitution classes because the underlying mechanism changes on different cadences and through different events. The decomposition lets the programme set a re-validation cadence per class rather than running a uniform calendar across the register.4,6,11
| Substitution class | Typical aging driver | Re-validation pattern |
|---|---|---|
| Configuration-based substitutes | Release-cadence configuration drift on the WAF rule, application firewall policy, access policy, or monitoring rule that performs the substitution. | Tie the substitute to the configuration item; flag the configuration item in change management; re-validate on every change event plus a baseline quarterly cadence. |
| Architecture-based substitutes | Slow-cadence change in network segmentation, isolated environments, deployment topology, or segregation of duties; large consequence per change because the substitute typically covers a wide surface. | Annual re-validation with event triggers on every architectural change that touches the substitute; document the architecture diagram as part of the evidence artefact. |
| Process-based substitutes | Operator turnover, process documentation aging, process compliance erosion; aging is invisible to system telemetry and surfaces in process audits or root-cause analysis. | Semi-annual process audit; sample-based compliance check against the documented procedure; refresh the documented procedure on every owner change. |
| Monitoring-based substitutes | Alert tuning, log retention changes, alert-fatigue dynamics; substitute remains visible in the register but no longer performs the substitution at the original confidence level. | Quarterly test of the detection path end-to-end; verify the alert fires, the alert is read, and the alert drives the documented response; refresh the captured evidence. |
Programmes that read the half-life decomposition rather than the headline currency rate prioritise the re-validation cadence that recovers the most defensible substitute layer. Configuration-based substitutes typically carry the highest event rate but the cheapest per-event re-validation; architecture-based substitutes typically carry the lowest event rate but the highest consequence per event; process-based and monitoring-based substitutes sit between with their own per-class disciplines.
How aging interacts with risk acceptance decay
Aged compensating controls compound with risk acceptance decay rather than running in parallel to it. A vulnerability exception or risk acceptance names the residual risk, the compensating control that justifies the acceptance, and the expiry. The exception register reads green if the named approver is active, the residual risk note is filed, and the expiry is in the future. The compensating control register reads green if the substitute is recorded. The compound failure is that the substitute has aged out without re-validation, so the exception is technically valid against the register but operationally undefended.10,18
Programmes that pair the exception register and the compensating control register as separate but joined queries surface this compound failure before the next audit. The join is a routine operational read: which exceptions reference which substitutes, what is the half-life shape of each substitute, what is the re-validation status of each substitute referenced by an active exception, what is the aging-event rate inside the quarter for substitutes that back active exceptions. The risk acceptance decay rate research covers the decision-side lifecycle; this research covers the substitute-side lifecycle; reading the two together separates a stale approver from a stale substitute from a stale framework citation from a stale primary-control reference. The exception renewal cadence economics research covers the cost design of the renewal cycle that ties the two registers together, including the compensating control re-validation component that this research prices in detail.
The audit-week query that reads a defensible exception requires both registers to be current. An exception with a fresh approver but a substitute whose evidence is older than the cadence window passes the field-presence check on the exception and fails the substitute-validity check. An exception with a fresh substitute but an approver who has departed without a recorded successor passes the substitute check and fails the accountability check. The two-register discipline keeps both axes on the same operating record so the audit citation does not require a reconciliation between two divergent spreadsheets.
Framework citations that expect substitutes to remain current
Most enterprise frameworks expect compensating controls to be documented, justified, monitored, and re-validated on a defined cadence. The audit query reads against the substitute documentation; the verification step checks operational currency; the artefact for substitute defensibility reads the re-validation event in the activity log. The pattern across frameworks is consistent enough that the same versioned substitute register and the same re-validation discipline satisfy citations across the in-scope framework set.1,2,4,5,7,8,9
| Framework | Compensating control citation | What the audit reads |
|---|---|---|
| PCI DSS v4.0 | Appendix B Compensating Controls Worksheet; Requirement 12.3.4 (review against changes that impact compliance) | Worksheet documenting how the substitute meets the intent and rigour of the original requirement, provides a similar level of defence, is commensurate with additional risk, and is re-evaluated annually as a minimum. |
| ISO 27001:2022 | A.5.7 (threat intelligence), A.5.37 (documented operating procedures), A.8.8 (vulnerability handling) | Substitutes read against the changing threat landscape; documented evidence currency; vulnerability handling tied to substitute documentation where the primary control is not implemented. |
| NIST SP 800-53 Rev. 5 | CA-5 (plan of action and milestones), PM-9 (risk management strategy), RA-5 (vulnerability scanning programme) | POA&M tracking of remediation actions including compensating controls; organisational discipline of substitute decisions; vulnerability handling tied to substitute documentation. |
| NIST CSF 2.0 | GV.RR (governance roles and responsibilities), GV.RM (risk management strategy), ID.RA (risk assessment) | Documented governance for substitute decisions; risk management strategy that includes substitute discipline; risk assessment reading current substitute validity. |
| SOC 2 Trust Services Criteria | CC3.2 (risk mitigation), CC3.4 (risk identification and assessment), CC9.1 (risk mitigation activities) | Risk mitigation activities including substitute discipline; evidence of substitute design and operating effectiveness; recurring evaluation of mitigation activities. |
| CIS Controls v8.1 | Compensating measures where safeguards cannot be implemented; safeguard 7.1 vulnerability management process | Documented compensating measures where the safeguard cannot be implemented as specified; vulnerability management process accommodating substitute decisions. |
| HITRUST CSF | Compensating control documentation with defined re-evaluation cadence | Documented substitute that performs the equivalent control function; defined re-evaluation cadence with refreshed evidence. |
| DORA | Articles 9 and 11 (ICT risk management framework) | ICT risk management framework reading substitute documentation as part of the overall risk treatment; recurring review of substitute decisions. |
The compensating control citation reads cleanly when the underlying register carries a versioned substitute description, a bound owner of record, a documented re-validation cadence, fresh evidence inside the cadence window, and a recorded re-validation event for each prior aging episode. When any of these properties are missing, the audit citation passes the field-presence check but fails the operational currency check; the audit then writes a finding against the substitute layer rather than against the underlying vulnerability handling. The audit evidence half-life research covers the evidence-currency dimension of this discipline; this research covers the substitute-currency dimension; the security control drift research covers the primary-control degradation dimension that interacts with the substitute layer.
The re-validation sweep in practice
A re-validation sweep is the operational routine that restores compensating control currency after a detected aging event. The sweep runs on a recurring cadence per substitution class (configuration quarterly with change-event triggers; architecture annually with event triggers; process semi-annually with owner-change triggers; monitoring quarterly with detection-tuning triggers) and on event triggers (configuration change, ownership departure, primary-control scope change, severity revision, framework update). The sweep reads the open compensating control register, joins each substitute to the live configuration record through the asset and control catalogue references, identifies aging candidates, and produces a re-validation worklist that a named operator processes against the current operating posture.5,6,8,13
At the substitute record layer
- The compensating control register is the canonical source for the substitute description, the framework citation, the bound owner, the effectiveness rating, the re-validation cadence, and the linked evidence artefact.
- The configuration record is the canonical source for the operating configuration that supports the substitute.
- The control catalogue is the canonical source for the primary control the substitute compensates for.
- The user register is the canonical source for the named owner identity, with workspace activity as the active-or-inactive signal.
At the cadence sweep layer
- The recurring sweep reads the compensating control register and resolves the current state of each substitute against the operating configuration, the bound owner, the linked evidence age, and the cited framework clause.
- Aging candidates land on a worklist with the aging event class, the previous state, and the proposed re-validation action.
- A named operator (GRC analyst, vulnerability programme manager, or security operations lead) processes each entry, runs the re-validation test, refreshes the evidence artefact, and updates the substitute record.
- The activity log captures the re-validation event so the audit citation for substitute currency reads as a recorded action rather than as inferred state.
At the event-triggered layer
- Configuration change on a compensating-control-bearing item triggers a sweep of the affected substitutes.
- Ownership departure of a bound owner triggers a sweep of substitutes bound to the departed identity.
- Primary-control scope change triggers a sweep of substitutes that reference the affected primary control.
- Severity revision on an underlying vulnerability triggers a sweep of substitutes covering the affected finding.
- Framework update triggers a sweep of substitutes citing the updated clause.
At the leadership reporting layer
- Compensating control currency rate, aging-event rate inside the quarter, and re-validation latency report alongside open-finding aging and remediation throughput on the same dashboard.
- Compensating-control-backed exception rate separates exceptions whose substitute has aged out from exceptions whose substitute is current.
- Re-validation worklist size is reported as a leading indicator of substitute layer health.
- Aging-rate decomposition by event class points the programme at the substrate change that needs the most upstream discipline.
For internal security teams, GRC, and vulnerability management leads
Compensating control hygiene is operational discipline that internal security teams, GRC owners, and vulnerability management leads run on the live record rather than as an audit-week reconciliation. The operating commitment is to bind every substitute to a versioned record, to resolve the current state at each query, and to record every re-validation event in the activity log so the substitute layer is a durable artefact rather than an inferred state.
For internal security teams, GRC and compliance teams, vulnerability management teams, security engineering teams, and security operations leaders, the compensating control register is one of the most under-instrumented layers in enterprise programmes. It looks tidy at audit week, it explains the open critical findings that are not yet remediated, and it carries the framework citation that lets the operational reality continue. The half-life view is the read that surfaces whether the substitute layer can survive the next assessment.
The operational counterpart of this research lives on the vulnerability acceptance and exception management use case, which describes the workflow that records the exception, the substitute, and the renewal cadence. The control gap remediation workflow use case covers the path from a recorded control gap to either a primary-control implementation or a documented compensating control. Pair both with the half-life view so the substitute layer reports currency alongside finding aging rather than as a separate quarterly reconciliation.
For security leadership and audit committees
Security leaders and audit committees read the substitute layer through a different lens than operational teams. The leadership read is whether the next assessment will read the compensating controls as defensible substitutes or as stale paper. A programme with a populated register and a twenty-percent aging-event rate inside the quarter is producing audit-week surprises; the headline currency rate hides the aging tail.
- Track compensating control currency rate, aging-event rate inside the quarter, re-validation latency, and compensating-control-backed exception rate as four separate lines rather than as one composite score.
- Read aging-rate decomposition by event class so the substrate change that needs upstream discipline is named explicitly.
- Investigate every critical-severity exception whose substitute has aged out individually; the target on critical-severity stale substitutes is zero.
- Pair the substitute register with the exception register and the primary-control catalogue so stale substitutes, stale exceptions, and stale primary controls surface together.
- Tie substitute tracking to the same engagement record the audit evidence comes from so the leadership read and the audit read are the same record rather than two reports.
The leadership question that drives this discipline is whether the substitute layer survives the next audit cycle without an audit-week reconciliation. If it does, the audit conversation is grounded in the live record and the operational conversation is grounded in the same place. If it does not, the audit-week reconciliation produces a derivative that has no operational equivalent and the audit citation passes only because the reconciliation is done. The multi-framework control crosswalk economics research covers the cross-framework dimension of substitute reuse, the continuous control monitoring cadence research covers the broader between-audits cadence, and this research covers the substitute-side half-life dimension.
The leadership-side platform discipline that supports this is covered on SecPortal for CISOs and security leaders, which describes how findings, remediation, retests, exceptions, and reporting hold the durable read of programme health between reporting cycles rather than only at quarterly review week.
How the engagement record carries the substitute layer
Substitute discipline gets cleaner when the finding, the exception, the compensating control record, the evidence artefact, and the activity log live on the same engagement record the operational work lives on, rather than on a static spreadsheet that diverges from operational reality after the next change event. The platform does not write the substitution narrative for the team; it does make every audit query for current compensating control validity reproducible from the live record at any moment between assessments.
SecPortal pairs every finding, asset binding, exception, remediation action, retest, and compensating control reference to a versioned engagement record through findings management, which holds the finding state, the owner field, the CVSS vector, and the remediation status on the finding rather than in a separate spreadsheet. Document management holds the compensating control records, the test evidence, the re-validation artefacts, and the framework justifications as versioned documents bound to the engagement and finding. The activity log captures every state change and re-validation event by user and timestamp with CSV export so the re-validation sweep produces evidence rather than spreadsheet output.
Notifications and alerts route renewal and re-validation work to the current owner so the cadence is visible at the moment it lapses. Team management with role-based access supplies the active workspace user record (owner, admin, member, viewer, billing roles) that the owner field references, so departed owners surface as inactive references rather than as silent stale data. Engagement management groups findings, exceptions, and compensating control records to a versioned engagement record so the per-engagement substitute view stays consistent. The compliance tracking view maps findings to ISO 27001, SOC 2, PCI DSS, NIST, Cyber Essentials, and additional framework catalogues with CSV export so the per-framework substitute citation reads against the same record. The AI report generation view regenerates the leadership read of compensating control status from the live record at any reporting moment rather than from a stale quarterly export.
For GRC and compliance teams, the discipline is that substitute citations regenerate from the live record at any audit-week query. For internal security teams, the operational reality is that the next exception renewal, the next critical finding, and the next audit fieldwork session read against a substitute layer whose currency is visible at the moment of query. For CISOs and security leaders, the operating commitment is that substitute currency holds across configuration, ownership, primary control, severity, and framework change between assessments.
Conclusion
Aged compensating control half-life is the substitute axis of vulnerability and compliance programme health. Compensating control currency, aging-event rate inside the quarter, and re-validation latency form a trio that separates a programme with a durable substitute layer from one that runs substitute hygiene as an audit-week sprint. Six canonical aging events (configuration drift, ownership departure, upstream scope change, severity revision, evidence aging, framework update) drive the bulk of aging across enterprise programmes, and each event has its own detection signature and its own re-validation pattern across configuration, architecture, process, and monitoring substitution classes.1,2,4,7
Treating compensating controls as a query against the live record rather than as a static field set at approval is the highest-leverage discipline in compensating control programme operations. It surfaces aging before it becomes an audit finding, it routes substitute decay to the right operational re-validation, it keeps exception renewals on substitutes that still perform the substitution, and it produces substitute citations that survive configuration, ownership, primary control, severity, and framework change across audit cycles. The platform you use does not have to write the substitution narrative for you. It does have to make every audit query for current compensating control validity reproducible from the live record at any moment between assessments.
Frequently Asked Questions
Sources
- PCI Security Standards Council, PCI DSS v4.0 (Requirement 12.3.4, Appendix B Compensating Controls Worksheet)
- ISO/IEC, ISO 27001:2022 Information Security Management Systems (Annex A 5.7, A.5.37)
- ISO/IEC, ISO 27002:2022 Information Security Controls
- NIST, SP 800-53 Revision 5: Security and Privacy Controls (CA-5 POA&M, PM-9 Risk Management Strategy)
- NIST, Cybersecurity Framework (CSF) 2.0 with GV.RR Governance Roles and Responsibilities
- NIST, SP 800-137 Information Security Continuous Monitoring (ISCM)
- AICPA, SOC 2 Trust Services Criteria (TSC) 2017 with 2022 Revisions (CC3.2 Risk Mitigation)
- CIS, Critical Security Controls v8.1
- HITRUST, CSF Framework
- CISA, Binding Operational Directive 22-01 Known Exploited Vulnerabilities
- FIRST, Common Vulnerability Scoring System (CVSS) Specification
- European Union, Digital Operational Resilience Act (DORA) Articles 9 and 11
- NIST, SP 800-39 Managing Information Security Risk
- SecPortal, Findings Management
- SecPortal, Document Management
- SecPortal, Activity Log
- SecPortal, Compliance Tracking
- SecPortal Research, Risk Acceptance Decay Rate
- SecPortal Research, Security Control Drift
- SecPortal Research, Audit Evidence Half-Life
Hold compensating controls current on the live engagement record
SecPortal keeps findings, exceptions, compensating control records, evidence artefacts, retests, and the activity log paired to one versioned engagement record so each audit query for current substitute validity regenerates from the live record rather than from a stale quarterly export.