Browse Definitions :

compensating control (alternative control)

What is compensating control?

A compensating control, also called an alternative control, is a mechanism that is put in place to satisfy the requirement for a security measure that is deemed too difficult or impractical to implement at the present time.

In the payment card industry (PCI), compensating controls were introduced in PCI DSS 1.0 by the PCI Security Standards Council (PCI SSC) in December 2004. Since then, the PCI SSC has released regular updates to the standard. The latest version -- 4.0 -- was published in March 2022. During the time between 1.0 and 4.0, the information about compensating controls changed in minor ways, but the guidelines as a whole have remained fairly consistent.

Per the PCI SSC, compensating controls give organizations an alternative to security requirements that cannot be met "due to legitimate and documented technical or business constraints." Compensating controls must sufficiently mitigate the risk associated with the original requirements. According to the PCI DSS, compensatory controls must do the following:

  • meet the intent and rigor of the original stated requirement;
  • provide a similar level of defense as the original PCI DSS requirement, such that the compensating control sufficiently offsets the risk that the original PCI DSS requirement was designed to defend against;
  • be "above and beyond" other PCI DSS requirements (simply being in compliance with other PCI DSS requirements is not a compensating control);
  • address the additional risk imposed by not adhering to the PCI DSS requirement; and
  • address the requirement currently and in the future; a compensating control cannot address a requirement that was missed in the past (for example, where performance of a task was required two quarters ago, but that task was not performed).
PCI DSS compliance levels
Compensating controls were introduced in PCI DSS 1.0 by the PCI Security Standards Council.

PCI DSS states that an assessor must evaluate each compensating control during the annual PCI DSS assessment. The assessor must confirm that each control addresses the risk targeted by the original PCI DSS requirement. As part of this process, the assessor must review and validate the control to ensure that it sufficiently meets its stated purpose.

The PCI DSS also stresses that the control's effectiveness depends on the environment in which it is implemented, as well as its configuration and the surrounding security controls. A compensating control is not effective in all environments.

The compensating controls worksheet

Appendix B of PCI DSS 4.0 includes additional details about compensating controls, and Appendix C provides a worksheet that organizations must complete if they've implemented compensating controls. The worksheet includes the following six sections:

  • Constraints. The legitimate technical or business constraints precluding compliance.
  • Definition of compensating controls. An explanation of how the compensating controls address the original objectives and the increased risks, if any.
  • Objectives. The objective of the original control and the objective met by the compensating control.
  • Identified risk. Additional risks posed by the lack of the original control.
  • Validation of compensating controls. An explanation of how the compensating controls were tested and validated.
  • Maintenance. The processes and controls that have been implemented to maintain compensating controls.

Compensating controls can be a valuable tool for organizations that have technical or business constraints that make it difficult to meet certain PCI DSS requirements. For example, PCI DSS requires the segregation of duties (SoD), an internal control designed to prevent error and fraud by ensuring that at least two individuals are responsible for the separate parts of any task. However, separating responsibilities in this way can be difficult for smaller organizations.

For instance, a small business might rely on a single individual to process and reconcile all the credit card transactions and to maintain all the related records. To comply with the SoD requirement, the business might implement a compensating control in which a third-party agent regularly reviews the transactions and relevant documentation -- as well as applicable logs and audit trails -- to verify the internal process. If the business implements this control, it must be included in the compensating controls worksheet.

See also: fraud detection, four eyes principlerisk avoidance, corporate governanceaccounting error, regulatory compliance, compliance burden.

This was last updated in October 2022

Continue Reading About compensating control (alternative control)

  • remote infrastructure management

    Remote infrastructure management, or RIM, is a comprehensive approach to handling and overseeing an organization's IT ...

  • port address translation (PAT)

    Port address translation (PAT) is a type of network address translation (NAT) that maps a network's private internal IPv4 ...

  • network fabric

    'Network fabric' is a general term used to describe underlying data network infrastructure as a whole.

  • governance, risk and compliance (GRC)

    Governance, risk and compliance (GRC) refers to an organization's strategy for handling the interdependencies among the following...

  • total risk

    Total risk is an assessment that identifies all the risk factors associated with pursuing a specific course of action.

  • steganography

    Steganography is the technique of hiding data within an ordinary, nonsecret file or message to avoid detection; the hidden data ...

  • microtargeting

    Microtargeting (also called micro-niche targeting) is a marketing strategy that uses consumer data and demographics to identify ...

  • business process

    A business process is an activity or set of activities that accomplish a specific organizational goal. Business processes should ...

  • business process improvement (BPI)

    Business process improvement (BPI) is a practice in which enterprise leaders analyze their business processes to identify areas ...

  • employee onboarding and offboarding

    Employee onboarding involves all the steps needed to get a new employee successfully deployed and productive, while offboarding ...

  • skill-based learning

    Skill-based learning develops students through hands-on practice and real-world application.

  • gamification

    Gamification is a strategy that integrates entertaining and immersive gaming elements into nongame contexts to enhance engagement...

Customer Experience
  • Microsoft Dynamics 365

    Dynamics 365 is a cloud-based portfolio of business applications from Microsoft that are designed to help organizations improve ...

  • Salesforce Commerce Cloud

    Salesforce Commerce Cloud is a cloud-based suite of products that enable e-commerce businesses to set up e-commerce sites, drive ...

  • Salesforce DX

    Salesforce DX, or SFDX, is a set of software development tools that lets developers build, test and ship many kinds of ...