Definition
Mitigating controls are safeguards implemented to reduce the likelihood or impact of a specific risk or threat. They do not eliminate the risk entirely but lower its potential severity or probability of occurrence. In practice, these controls act as secondary defenses or compensating measures when primary controls are insufficient or absent. Understanding mitigating controls is crucial for effective risk management, allowing professionals to justify security decisions and explain residual risk. For instance, implementing multi factor authentication for remote access serves as a mitigating control for the risk of compromised credentials. Unlike preventative controls that aim to stop an incident before it happens, mitigating controls focus on lessening the damage if an incident does occur. This concept is frequently covered in domains related to risk management and security operations on exams like Security+ and CySA+.