Quick answer: A compensating control is an alternative safeguard used when an organization cannot implement a required security control because of a legitimate technical or business constraint. It must meet the intent of the original requirement and provide a similar level of protection. For example, if a legacy system cannot support multifactor authentication, it might be isolated on a separate network segment with strict access through a jump host that does require MFA.
Real environments include legacy systems, specialist equipment and vendor limits that do not fit every rule. Compensating controls keep risk acceptable when the standard control is not possible. This guide explains how they work, gives examples and covers how to document them.
Examples of compensating controls
| Required control that cannot be met | Possible compensating control |
|---|---|
| MFA on a legacy application | Network isolation with access only through an MFA-protected jump host |
| Patching an unsupported operating system | Segmentation, application allowlisting and enhanced monitoring |
| Separation of duties in a very small team | Independent review of logs and transactions |
| Encryption on an old database | Strict access control, data masking and file-level protection |
| Endpoint agent on industrial equipment | Network monitoring and tightly controlled remote access |
Each example combines several measures, because a single substitute rarely matches the strength of the original control. That combination approach is typical of acceptable compensating controls.
Compensating controls in PCI DSS
PCI DSS allows compensating controls when an entity has a legitimate constraint. They must meet the intent and rigor of the original requirement, provide a similar level of defense and go beyond other requirements already in place. Each one is documented in a compensating controls worksheet and validated by the assessor. Supporting documents are in the PCI SSC document library.
Compensating controls in NIST frameworks
NIST defines compensating controls in its glossary as controls used in place of recommended ones that provide equivalent or comparable protection. Our overview of types of security controls explains where they fit alongside preventive, detective and corrective controls.
How to implement and document one
- Record why the original control cannot be implemented.
- Analyze the risk the original control was meant to address.
- Design a combination of measures that addresses that risk.
- Test that the measures work.
- Document everything and set a review date.
- Track a long-term plan to meet the original requirement in your POA&M.
Compensating controls often emerge from a gap analysis and are a common way of fixing a risk or control gap in the short term. Network isolation techniques are covered in network segmentation vs microsegmentation.
Frequently asked questions
What is a compensating control?
It is an alternative safeguard that provides comparable protection when a required control cannot be implemented because of a legitimate constraint.
Is a compensating control permanent?
It can last a long time, but it should be reviewed regularly and replaced with the original control when the constraint is removed.
Can cost be a reason for a compensating control?
Standards such as PCI DSS generally expect a legitimate technical or documented business constraint; simply preferring not to pay is unlikely to be accepted.
What is the difference between compensating and mitigating controls?
Mitigating controls reduce risk in general. A compensating control specifically substitutes for a required control that cannot be implemented.
Conclusion
Compensating controls keep security realistic without lowering standards. Use them only for genuine constraints, combine several measures, test them and document them thoroughly. Keep working toward the original control wherever possible.
