How do you assess whether a vulnerability should be remediated immediately or deferred with compensating controls?
