What is a compensating control?
A compensating control is an alternative safeguard used when a required control cannot be implemented as written. It is documented with the reason, shown to reduce the risk to a similar level, and accepted by the risk owner.
When they are used
The usual cases are practical. A legacy system cannot support multi-factor authentication. A supplier’s appliance cannot be patched on the normal schedule. A team is too small for one person to write code and another to deploy it.
In each case the answer is a different control that reaches the same goal. The legacy system is isolated on its own network segment with extra monitoring. The appliance sits behind tighter firewall rules. Every deployment is reviewed afterwards by someone who did not make it. The record states the constraint, the original requirement, the risk, the alternative, and how its operation is checked.
The PCI DSS rules
PCI DSS sets the most detailed rules. A compensating control is allowed where a legitimate technical or documented business constraint prevents meeting a requirement as stated. Appendix B sets the criteria, and the worksheet in Appendix C records the constraint, objective, identified risk, the control, how it was validated and how it is maintained. The assessor reviews and validates it at each assessment.
- Intent and rigour. It meets the intent and rigour of the original requirement.
- Similar defence. It provides a similar level of defence.
- Above and beyond. It goes beyond other PCI DSS requirements, so a control already required elsewhere does not count.
- Proportionate. It matches the extra risk created by not meeting the original requirement.
In other frameworks
The HIPAA Security Rule has a similar idea for its “addressable” specifications. If one is not reasonable and appropriate, you document why and put in place an equivalent alternative measure where that is reasonable and appropriate. HHS has proposed changes to the Security Rule that would remove this distinction, so check the rule in force.
ISO 27001 has no formal mechanism, because you choose controls through risk treatment in the first place. An alternative control is simply the control you selected, justified in the risk treatment plan and the Statement of Applicability, with the risk owner accepting what risk remains.
Questions
Compensating control, answered
Is a compensating control permanent?
It can last as long as the constraint does, but it should be reviewed regularly. Most organisations treat it as a step towards meeting the original requirement, with a plan and a date for doing so.
How is it different from accepting the risk?
A risk acceptance records that the risk owner will live with a risk as it is. A compensating control reduces the risk by other means, and the owner accepts only what remains. Auditors give far more weight to the second.
Who approves a compensating control?
The risk owner accepts it internally. Under PCI DSS, the assessor must also review and validate it at each assessment.
Working through this for an audit?
Talk it through with someone who has run the audit before, or look up another term.
- Each customer workspace has its own database
- Every change written to a tamper-evident activity log
- Auditors get scoped, read-only access
- AI suggestions wait for a person to accept them