thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Governance, Risk, Audit & Privacy · Intermediate

Compensating Control

Alternative control used when a primary control cannot be implemented, providing equivalent risk reduction.

Definition

Compensating controls address the intent of a requirement when the original control is infeasible due to technical or business constraints. PCI DSS requires compensating controls to meet the intent and rigor of the requirement, go above and beyond other requirements, and be documented and validated. They should be temporary where possible.

Example

A legacy system that cannot support MFA is isolated on a segmented network with jump host access and enhanced monitoring.

Exam tip

In PCI DSS v4.0 the customized approach is an alternative to compensating controls for mature entities.

Related terms