Compensating control
Also known as: Alternative control, Mitigation measure, Substitute control
A compensating control is an alternative security measure implemented when a primary requirement or standard control cannot be met due to technical or business constraints. It is designed to provide a level of protection equivalent to the original requirement, effectively mitigating the risk to an acceptable level. This allows an organization to remain compliant even if a specific mandatory control is absent.
In practice
During an audit, this occurs when a client cannot implement a mandated control—such as multi-factor authentication on a legacy system—and instead provides evidence of restricted network access and enhanced logging to offset the risk. The auditor then evaluates whether these alternative measures sufficiently reduce the vulnerability.