Skip to content

Compensating Control

What is Compensating Control?

An alternative security measure employed when a primary control cannot be implemented. Must provide an equivalent level of protection and be documented with justification.

Information Security

Related terms

Control

Frameworks that govern compensating control

ISO 27001:2022View framework →NIST Cybersecurity Framework 2.0View framework →CIS Controls v8View framework →

What the standards actually require on compensating control

Requirements naming compensating control across 6 standards, quoted from the control text.

IAEA Nuclear Security Series - Computer Security at Nuclear Facilities (NSS-17-T Rev 1)2 controls

NSS-17 + NSS-42-G require facility computer security architecture organised by Computer Security Zones (CSZs) implementing IAEA zone model.

IAEA-NSS17-Architecture-Zones-DefenceInDepth-Segmentation · IAEA NSS-17 - Computer Security Architecture + Zone Model + Defence in Depth + Network Segmentation + Boundary →
NIST SP 800-82 Revision 3: Guide to Industrial Control Systems (ICS) Security2 controls

Operate OT supply chain + asset lifecycle + physical security per NIST SP 800-82 Rev 3 Chapter 6 + Chapter 7. OT Supply Chain Security must (a) qualify OT vendors and suppliers per NIST SP 800-161 Supply Chain Risk Management tailored to OT (vendor cybersecuri...

NISTSP82-8 · OT Supply Chain Security, Asset Lifecycle, and Physical Security →
API 11641 control

Identify, evaluate, and apply patches and compensating controls to SCADA assets following risk-based prioritization.

API1164-09 · Patch and Vulnerability Management →
Australian Information Security Manual1 control

When applications, operating systems, network devices or networked IT equipment that are no longer supported by vendors cannot be immediately removed or replaced, compensating controls are implemented until such time that they can be removed or replaced.

ISM-1809 · When applications, operating systems, network devices or networked IT equipment that are n →
Azure Security Benchmark1 control

Detect insecure services and protocols at operating system, application and package layers and disable them, applying compensating controls where they cannot be disabled.

ASBv3-NS-8 · Detect and disable insecure services and protocols →
Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.11 control

Restrict traffic between environments to authenticated and authorised connections, encrypt and monitor it, and review the configuration at least annually with a written justification for every allowed service, protocol, port and compensating control.

CCM-IVS-03 · Network Security →

Questions people ask about compensating control

What is Compensating Control?
An alternative security measure employed when a primary control cannot be implemented. Must provide an equivalent level of protection and be documented with justification.
Why is Compensating Control important for compliance?
Compensating Control is a key concept in Information Security. Understanding compensating control helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 686 frameworks with 311K cross-framework control mappings.
What concepts are related to Compensating Control?
Key concepts related to Compensating Control include Control. Understanding these interconnected concepts provides a more comprehensive view of Information Security requirements and helps organizations build holistic compliance programs.
Which compliance frameworks address Compensating Control?
Compensating Control appears in the requirement text of IAEA Nuclear Security Series - Computer Security at Nuclear Facilities (NSS-17-T Rev 1), NIST SP 800-82 Revision 3: Guide to Industrial Control Systems (ICS) Security, API 1164, Australian Information Security Manual, Azure Security Benchmark. Across these standards we have identified 8 controls that name it directly, each linked to the control text on the compliance platform.
Where can I learn more about Compensating Control?
Explore our compliance framework pages to see how compensating control applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 686 frameworks.

See how Compensating Control applies across compliance frameworks

Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.

Explore on Platform
Written and maintained by Gerard Blokdyk, The Art of Service.