Where should compensating controls be documented when used to meet a PCI DSS requirement?

Where should compensating controls be documented when used to meet a PCI DSS requirement?

• A. In the Report on Compliance in the corresponding PCI DSS requirement section
• B. In the annual security report
• C. In the network architecture diagram
• D. In the system inventory

Answer: (A)

When compensating controls are used to meet a PCI DSS requirement, they belong in the formal PCI DSS documentation that accompanies the assessment—the Report on Compliance—under the section for the specific requirement being addressed. This section documents not only that an alternative control was put in place, but also the justification for needing it, how the compensating control achieves the same security objective, and the testing and ongoing monitoring that demonstrate its effectiveness. This focused documentation allows assessors and card brands to review the rationale and evidence, ensuring the compensating control truly meets the intended risk mitigation. The other options don’t fit because they aren’t the formal repository for how a requirement was met via alternatives. The annual security report is not part of PCI DSS validation, and network diagrams or system inventories document architecture and assets rather than the justification, design, and evidence of compensating controls used to satisfy a requirement.

When compensating controls are used to meet a PCI DSS requirement, they belong in the formal PCI DSS documentation that accompanies the assessment—the Report on Compliance—under the section for the specific requirement being addressed. This section documents not only that an alternative control was put in place, but also the justification for needing it, how the compensating control achieves the same security objective, and the testing and ongoing monitoring that demonstrate its effectiveness. This focused documentation allows assessors and card brands to review the rationale and evidence, ensuring the compensating control truly meets the intended risk mitigation.

The other options don’t fit because they aren’t the formal repository for how a requirement was met via alternatives. The annual security report is not part of PCI DSS validation, and network diagrams or system inventories document architecture and assets rather than the justification, design, and evidence of compensating controls used to satisfy a requirement.