What must be true about compensating controls when used?

What must be true about compensating controls when used?

• A. They must be documented in ROC
• B. They must be undocumented
• C. They replace all other controls
• D. They are optional

Answer: (A)

Compensating controls are alternative measures you put in place when you cannot meet a PCI DSS requirement, and they must be documented in the ROC so there is formal justification, testing, and approval for their use. They must demonstrate they achieve the same security objective as the original control, not simply be added arbitrarily. They are not optional, nor do they replace all other controls; they’re specific accommodations that require evidence and validation within the assessment.

Compensating controls are alternative measures you put in place when you cannot meet a PCI DSS requirement, and they must be documented in the ROC so there is formal justification, testing, and approval for their use. They must demonstrate they achieve the same security objective as the original control, not simply be added arbitrarily. They are not optional, nor do they replace all other controls; they’re specific accommodations that require evidence and validation within the assessment.