S02E09

What Is a Compensating Control?

A compensating control is an alternative safeguard used when the preferred or required control cannot be implemented because of technical, operational, financial, or compatibility constraints. Certification questions may ask candidates to select a measure that reduces comparable risk without claiming to eliminate the original weakness. For example, a legacy server that cannot support multifactor authentication might be isolated on a restricted network, monitored continuously, and accessible only through a secured administrative gateway. The alternative should address the same security objective as closely as possible and be supported by documented risk analysis and approval. Organizations must also test the control, monitor its effectiveness, record its limitations, and revisit the preferred solution when conditions change. Produced by BareMetalCyber.com, where you’ll find more cyber audio courses, books, and information to strengthen your educational path. Also, if you want to stay up to date with the latest news, visit DailyCyber.News for a newsletter you can use, and a daily podcast you can commute with. And dont forget Cyberauthor.me for the companion study guide and flash cards!