[cavilatrest]

While I agree, I think we can admit that doing so will take some time. Would it not be appropriate to have compensating controls in the meantime?

[oneeyedpigeon]

The trouble is, temporary compensating controls have a history of becoming permanent once in place, so you need to be absolutely sure you want those controls forever.

[cavilatrest]

That's a good point, and while I hesitate to think about this terms of pure risk management, the same stuff happens in my company.