Compensating Control — A compensating control addresses a security requirement through an alternative measure when the preferred measure is impractical. It should provide suitable protection against the relevant risk. Organizations document its rationale, limitations, and continued effectiveness rather than treating it as a permanent exemption. – Security Control

Added October 7, 2026