Browse Definitions :

compensating control (alternative control)

What is compensating control?

A compensating control, also called an alternative control, is a mechanism that is put in place to satisfy the requirement for a security measure that is deemed too difficult or impractical to implement at the present time.

In the payment card industry (PCI), compensating controls were introduced in PCI DSS 1.0 by the PCI Security Standards Council (PCI SSC) in December 2004. Since then, the PCI SSC has released regular updates to the standard. The latest version -- 4.0 -- was published in March 2022. During the time between 1.0 and 4.0, the information about compensating controls changed in minor ways, but the guidelines as a whole have remained fairly consistent.

Per the PCI SSC, compensating controls give organizations an alternative to security requirements that cannot be met "due to legitimate and documented technical or business constraints." Compensating controls must sufficiently mitigate the risk associated with the original requirements. According to the PCI DSS, compensatory controls must do the following:

  • meet the intent and rigor of the original stated requirement;
  • provide a similar level of defense as the original PCI DSS requirement, such that the compensating control sufficiently offsets the risk that the original PCI DSS requirement was designed to defend against;
  • be "above and beyond" other PCI DSS requirements (simply being in compliance with other PCI DSS requirements is not a compensating control);
  • address the additional risk imposed by not adhering to the PCI DSS requirement; and
  • address the requirement currently and in the future; a compensating control cannot address a requirement that was missed in the past (for example, where performance of a task was required two quarters ago, but that task was not performed).
PCI DSS compliance levels
Compensating controls were introduced in PCI DSS 1.0 by the PCI Security Standards Council.

PCI DSS states that an assessor must evaluate each compensating control during the annual PCI DSS assessment. The assessor must confirm that each control addresses the risk targeted by the original PCI DSS requirement. As part of this process, the assessor must review and validate the control to ensure that it sufficiently meets its stated purpose.

The PCI DSS also stresses that the control's effectiveness depends on the environment in which it is implemented, as well as its configuration and the surrounding security controls. A compensating control is not effective in all environments.

The compensating controls worksheet

Appendix B of PCI DSS 4.0 includes additional details about compensating controls, and Appendix C provides a worksheet that organizations must complete if they've implemented compensating controls. The worksheet includes the following six sections:

  • Constraints. The legitimate technical or business constraints precluding compliance.
  • Definition of compensating controls. An explanation of how the compensating controls address the original objectives and the increased risks, if any.
  • Objectives. The objective of the original control and the objective met by the compensating control.
  • Identified risk. Additional risks posed by the lack of the original control.
  • Validation of compensating controls. An explanation of how the compensating controls were tested and validated.
  • Maintenance. The processes and controls that have been implemented to maintain compensating controls.

Compensating controls can be a valuable tool for organizations that have technical or business constraints that make it difficult to meet certain PCI DSS requirements. For example, PCI DSS requires the segregation of duties (SoD), an internal control designed to prevent error and fraud by ensuring that at least two individuals are responsible for the separate parts of any task. However, separating responsibilities in this way can be difficult for smaller organizations.

For instance, a small business might rely on a single individual to process and reconcile all the credit card transactions and to maintain all the related records. To comply with the SoD requirement, the business might implement a compensating control in which a third-party agent regularly reviews the transactions and relevant documentation -- as well as applicable logs and audit trails -- to verify the internal process. If the business implements this control, it must be included in the compensating controls worksheet.

See also: fraud detection, four eyes principle, risk avoidance, corporate governance, accounting error, regulatory compliance, compliance burden.

This was last updated in October 2022

Continue Reading About compensating control (alternative control)

  • cloud security

    Cloud security, also known as 'cloud computing security,' is a set of policies, practices and controls deployed to protect ...

  • privacy impact assessment (PIA)

    A privacy impact assessment (PIA) is a method for identifying and assessing privacy risks throughout the development lifecycle of...

  • proof of concept (PoC) exploit

    A proof of concept (PoC) exploit is a nonharmful attack against a computer or network. PoC exploits are not meant to cause harm, ...

  • data collection

    Data collection is the process of gathering data for use in business decision-making, strategic planning, research and other ...

  • chief trust officer

    A chief trust officer (CTrO) in the IT industry is an executive job title given to the person responsible for building confidence...

  • green IT (green information technology)

    Green IT (green information technology) is the practice of creating and using environmentally sustainable computing resources.

  • diversity, equity and inclusion (DEI)

    Diversity, equity and inclusion is a term used to describe policies and programs that promote the representation and ...

  • ADP Mobile Solutions

    ADP Mobile Solutions is a self-service mobile app that enables employees to access work records such as pay, schedules, timecards...

  • director of employee engagement

    Director of employee engagement is one of the job titles for a human resources (HR) manager who is responsible for an ...

Customer Experience
  • digital marketing

    Digital marketing is the promotion and marketing of goods and services to consumers through digital channels and electronic ...

  • contact center schedule adherence

    Contact center schedule adherence is a standard metric used in business contact centers to determine whether contact center ...

  • customer retention

    Customer retention is a metric that measures customer loyalty, or an organization's ability to retain customers over time.