Hi Alessandro,
I've found that the mitigating control ID is modifiable in SP10 and above.
There were some mitigating controls that were used for testing and were no longer in use. Instead of just leaving them, I'm reusing them. These controls haven't been mitigated yet so the system is allowing changes to them. I've found that the system warns if it is mitigating an AC risk.
I've been testing changing the mitigating control ID in other systems and haven't found any impact as of yet. But I'm trying to determine if there is anything that I may have overlooked. The mitigating control still has no AC reports attached to it.
Thank you for the advice and I'm looking into it. Also thank you for the Vcard.
Best Regards,
Raphael
