Under what conditions may compensating controls be considered for PCI DSS requirements?

Under what conditions may compensating controls be considered for PCI DSS requirements?

• A. The requirement can be met exactly as stated.
• B. There are legitimate technical or documented business constraints, but risk is mitigated with other controls.
• C. The organization ignores the requirement.
• D. The data is publicly accessible.

Answer: (B)

Compensating controls are considered only when there are legitimate technical or documented business constraints that prevent meeting a PCI DSS requirement exactly. In that situation, you design alternate controls that deliver the same level of protection and meet the same security objective as the original requirement. The risk must be mitigated by these other measures, and the arrangement needs formal approval and validation—typically by a Qualified Security Assessor and the card brands—with thorough documentation showing how the compensating controls achieve the same protection as the requirement. This approach isn’t a license to ignore a requirement. It’s a carefully justified, temporary (or interim) substitute you use while the constraint is addressed or while the primary control is implemented. The other options don’t fit because meeting the requirement exactly eliminates the need for compensating controls; ignoring the requirement is not allowed; and making data publicly accessible would create risk that compensating controls cannot justify.

Compensating controls are considered only when there are legitimate technical or documented business constraints that prevent meeting a PCI DSS requirement exactly. In that situation, you design alternate controls that deliver the same level of protection and meet the same security objective as the original requirement. The risk must be mitigated by these other measures, and the arrangement needs formal approval and validation—typically by a Qualified Security Assessor and the card brands—with thorough documentation showing how the compensating controls achieve the same protection as the requirement.

This approach isn’t a license to ignore a requirement. It’s a carefully justified, temporary (or interim) substitute you use while the constraint is addressed or while the primary control is implemented. The other options don’t fit because meeting the requirement exactly eliminates the need for compensating controls; ignoring the requirement is not allowed; and making data publicly accessible would create risk that compensating controls cannot justify.