What it means
The alternate should provide comparable protection, be supported by risk analysis, have defined ownership and evidence, and receive appropriate approval.
Why it matters
Compensating controls allow practical flexibility without silently abandoning the requirement or accepting unknown exposure.
Practical focus
- Identify the original control objective
- Explain why the prescribed method is not feasible
- Compare expected protection and limitations
- Approve, monitor, and periodically revisit the exception
Common mistakes
- Calling any existing control compensating
- Using cost alone as the justification
- Ignoring new operational burden
- Leaving temporary compensating controls in place indefinitely
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: