For instance, these standards may implement compensating controls that reduce the probability or effectiveness of an exploited vulnerability.