The organization cannot completely block the malicious URL because it remains necessary for a legitimate business process. Instead, the security team is implementing compensating controls that reduce exposure while preserving required functionality. These controls include limiting access to explicitly authorized users, restricting network paths through firewall and cloud security-group rules, increasing monitoring, and ensuring that systems interacting with the external resource are fully patched.

A compensating control is an alternative safeguard used when the preferred control—such as completely removing access to the risky resource—is operationally impractical. The important distinction is that the underlying risk still exists; the organization is reducing its likelihood or potential impact through layered protections.

Patching is only one component of the response and therefore does not describe the overall mitigation. Configuration management concerns maintaining approved system configurations and controlling changes. Attack surface management focuses on identifying and reducing externally or internally exposed assets and services, but the scenario specifically describes alternative safeguards around a business-required risk.

The combination of access restriction, enhanced monitoring, and system hardening is therefore characteristic of compensating-control implementation.

Study Guide Reference: Vulnerability Management → Vulnerability Mitigation → Compensating Controls → Network Segmentation → Monitoring → Patch Management → Risk-Based Remediation.