Cybersecurity Comprehensive Compensating Controls Where Patching Is Impossible | Enterprise Security Guide

Comprehensive compensating controls are layered technical, administrative, and monitoring safeguards implemented to reduce cyber risk when a system cannot be patched without unacceptable operational, safety, regulatory, or business impact.

In many enterprise environments, patching is not immediately feasible. Industrial control systems, medical devices, legacy applications with high levels of technical debt, embedded appliances, unsupported operating systems, and business-critical platforms often remain unpatched for extended periods. The security objective is not to accept unmanaged risk; it is to build a defensible control framework that prevents exploitation, limits attacker movement, detects malicious activity rapidly, and demonstrates governance to auditors and regulators.

This guide presents a practical, enterprise-grade strategy for implementing compensating controls where patching is impossible. 

For details on how compensating controls can be applied as part of compliance with ISO 27001:2022 Control 8.8 Management of Technical Vulnerabilities see here.

Key Stages of a Compensating Control Program

Identify Every Unpatchable Asset

We begin with a precise inventory. Unknown assets cannot be protected.

For each unpatchable system, document:

• Hostname, IP address, operating system, and version
• Installed applications and services
• Business owner and technical owner
• Data classification
• Network location and connectivity paths
• Internet exposure status
• Vendor support status
• Reason patching is impossible
• Planned retirement or replacement date

Prioritize assets that are internet-facing, process sensitive data, provide authentication services, or connect to production networks.

Perform a Threat-Focused Risk Assessment

A compensating control program must be driven by exploitability, not by vulnerability count alone.

Assess:

• Presence of known exploited vulnerabilities (KEVs)
• Availability of public exploit code
• Required attacker access (remote, authenticated, local)
• Existing network exposure
• Potential business impact
• Likelihood of lateral movement
• Detectability of exploitation attempts

Use a simple multiplication to measure the Exploitability X the Business Impact to calculate the overall business Priority. Document the residual risk after controls are applied.

Reduce Exposure Before Adding Complex Controls

The most effective compensating control is often eliminating unnecessary exposure.

Remove Internet Reachability

If the system does not require internet access, block all inbound and outbound internet traffic.

• Remove public IP addresses
• Disable port forwarding
• Restrict VPN access
• Use private management networks

Disable Unused Services

Disable:

• SMBv1
• Telnet
• FTP
• RDP if not required
• Legacy web interfaces
• Unused APIs
• Printer and discovery services

Every disabled service removes an attack path.

Enforce Network Segmentation

Place unpatchable systems in dedicated security zones.

Recommended architecture:

• User network
• Server network
• Legacy/unpatchable zone
• Management zone
• Backup zone

Allow only explicitly required traffic between zones.

Example firewall policy:

• Permit application server → legacy database on TCP 1521
• Permit jump host → legacy server on TCP 3389
• Deny all other traffic

Implement Strong Access Controls

Multi-Factor Authentication

Require MFA for all administrative access paths.

Apply MFA to:

• VPNs
• Jump hosts
• Privileged access management platforms
• Remote desktop gateways
• SSH bastions

Privileged Access Management

Use PAM to:

• Eliminate shared accounts
• Rotate passwords automatically
• Record privileged sessions
• Enforce approval workflows
• Provide just-in-time access

Dedicated Administration Workstations

Administrators should manage unpatchable assets only from hardened management workstations isolated from email and web browsing.

Use Virtual Patching to Block Exploit Paths

Virtual patching reduces exploitability without modifying the vulnerable system.

Intrusion Prevention Systems

Deploy IPS signatures for known vulnerabilities affecting the asset.

Web Application Firewall

For legacy web applications:

• Block malicious payloads
• Enforce protocol compliance
• Restrict HTTP methods
• Validate input length and format
• Detect common exploit patterns

Protocol Whitelisting

Permit only required protocol operations. For example, allow read-only Modbus function codes where operationally possible.

Harden the Host Aggressively

Even unsupported systems can usually be hardened.

Application Allowlisting

Allow only approved executables, scripts, and libraries.

Benefits:

• Blocks commodity malware
• Prevents unauthorized tools
• Reduces ransomware execution risk

Remove Administrative Rights

Users should not have local administrator privileges on legacy systems unless operationally unavoidable.

Secure Configuration Baselines

Apply available hardening guidance:

• Disable macros
• Disable script interpreters if unused
• Restrict PowerShell
• Disable autorun
• Enforce strong password policies
• Enable host firewall

Document any deviations required for operations.

Deploy Endpoint Detection and Response

Traditional antivirus is insufficient for unpatchable assets.

Configure EDR to:

• Detect exploit behavior
• Monitor credential access
• Detect persistence mechanisms
• Identify suspicious network connections
• Alert on privilege escalation
• Contain compromised hosts

Where agents are unsupported, use network-based detection and log collection from adjacent systems.

Centralize Logging and Continuous Monitoring

A compensating control strategy fails without visibility.

Collect:

• Authentication logs
• Process creation events
• Network connection logs
• Firewall logs
• IDS/IPS events
• WAF events
• EDR telemetry
• Configuration changes
• Backup activity

Forward logs to a SIEM and create high-priority alerts for:

• New administrative accounts
• Failed login bursts
• Remote execution tools
• Unexpected outbound traffic
• Lateral movement protocols
• Disabled security controls

Retain logs according to regulatory requirements.

Protect Credentials and Secrets

Attackers frequently target legacy systems for credential theft.

Controls include:

• Unique local administrator passwords
• Password rotation
• Service account minimization
• Credential vaulting
• Kerberos over NTLM where possible
• Disable cached credentials if operationally acceptable
• Monitor privileged account usage

Never store passwords in scripts, scheduled tasks, or configuration files.

Establish Operational Safeguards

Formal Change Control

Require approval for:

• Configuration changes
• Firewall rule modifications
• Remote access enablement
• Software installation
• Maintenance activities

Maintenance Windows

Restrict administrative access to defined maintenance windows and monitor all sessions.

Vendor Access Management

Provide vendors with time-limited access through monitored jump hosts. Disable accounts immediately after use.

Validate Control Effectiveness

Compensating controls must be tested regularly.

Technical Validation

Perform:

• Vulnerability scanning from adjacent networks
• Firewall rule reviews
• Segmentation testing
• Configuration compliance checks
• EDR policy verification

Adversary Simulation

Conduct penetration testing focused on:

• Initial access
• Privilege escalation
• Credential theft
• Lateral movement
• Data exfiltration

Document findings and remediation actions.

Maintain Secure Backups and Recovery

Assume compromise is still possible.

Implement:

• Offline or immutable backups
• Backup encryption
• Separate backup credentials
• Regular restoration testing
• Recovery time objectives
• Recovery point objectives

A tested recovery process is a critical compensating control against ransomware.

Example: Legacy Windows Server Running a Critical Application

Scenario

• Windows Server 2008 R2
• Unsupported vendor application
• Cannot patch for 12 months

Compensating Control Stack

‍

This layered approach materially reduces the likelihood and impact of exploitation despite the missing patches.

Industrial Control System Example

For OT environments:

• Separate OT and IT networks
• Use data diodes where feasible
• Restrict engineering workstation access
• Disable removable media
• Monitor industrial protocols
• Maintain offline backups of controller configurations
• Implement strict vendor access procedures

Safety and availability requirements often make these controls more important than immediate patching.

Compliance and Audit Documentation

Auditors expect evidence that compensating controls provide equivalent risk reduction.

Maintain:

• Asset inventory
• Risk assessment
• Control matrix
• Firewall rule sets
• Access reviews
• Monitoring procedures
• Incident response playbooks
• Test results
• Management approvals
• Risk acceptance records
• Review dates

Map controls to frameworks such as ISO 27001:2022, NIST CSF 2.0, CIS Controls, and sector-specific regulations.

Governance: When Is Risk Acceptance Appropriate?

Risk acceptance should be:

• Explicit
• Time-bound
• Approved by accountable management
• Supported by documented compensating controls
• Reviewed regularly

Avoid indefinite acceptance. Every unpatchable asset should have a remediation, replacement, or decommissioning plan.

Common Mistakes That Increase Risk

• Leaving legacy systems internet-facing
• Using shared administrator accounts
• Allowing unrestricted lateral movement
• Disabling logging to improve performance
• Failing to test backups
• Relying solely on antivirus
• Ignoring vendor remote access pathways
• Not reviewing firewall rules after changes
• Treating compensating controls as permanent solutions

Recommended Review Cadence

‍

Conclusion

When patching is impossible, security depends on disciplined compensating controls rather than hope. A robust program combines asset visibility, network isolation, strict access control, virtual patching, endpoint detection, continuous monitoring, operational governance, and regular validation. The goal is not to eliminate vulnerability; it is to make successful exploitation significantly more difficult, limit attacker impact, detect compromise rapidly, and maintain defensible compliance and operational resilience until the asset can be patched, replaced, or retired.

‍