Compensating Control
What is Compensating Control?
An alternative security measure employed when a primary control cannot be implemented. Must provide an equivalent level of protection and be documented with justification.
Related terms
Frameworks that govern compensating control
What the standards actually require on compensating control
Requirements naming compensating control across 6 standards, quoted from the control text.
CSO-approved compensating controls for advanced authentication on agency-issued smartphones and tablets with limited-feature operating systems are permitted as temporary measures where a legitimate technical or business constraint prevents compliance, only aft...
fbi-cjis-security-policy::5.20.7.2.1 · 5.20.7.2.1 Compensating Controls →A section for the manufacturer to enter security risk considerations or controls, compensating controls included, that are not categorised elsewhere in the form.
mds2-medical-device::OTHR · OTHR Other security considerations: disclose security risks and controls not covered elsewhere, compensating controls included →DSPs encrypt data stored for tax, accounting, payroll, business registry and superannuation transactions, including personally identifiable information, at the disk, container, application or database level, or by partial encryption at block, field or column l...
ato-digital-service-provider-dsp-operational-security-framework::SEC.EAR · Encryption at rest of in-scope data, or the four compensating controls →Cybersecurity controls are implemented for all assets within the function, at the asset level where feasible and through compensating controls where not.
australian-energy-sector-cyber-security-framework-aescsf::ARCHITECTURE-3h · ARCHITECTURE-3h: Controls on all assets or compensating controls →In special cases where individual user IDs and passwords are not practical, a risk assessment should be carried out and compensating controls applied.
new-zealand-information-security-manual-nzism::19.5.27.C.05 · 19.5.27.C.05 Compensating controls where individual credentials are impractical →Internal controls V: upon learning of a weakness in OFAC internal controls, the organisation takes immediate and effective action to identify and implement compensating controls until the root cause is determined and remediated.
us-ofac-sanctions-compliance-framework::IC.V · On learning of a control weakness, apply compensating controls until the root cause is fixed →Questions people ask about compensating control
What is Compensating Control?
Why is Compensating Control important for compliance?
What concepts are related to Compensating Control?
Which compliance frameworks address Compensating Control?
Where can I learn more about Compensating Control?
See how Compensating Control applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.