Definition
A compensating control is a security measure implemented when a primary or preferred security control cannot be put in place or is otherwise unavailable. It serves as an alternative safeguard designed to mitigate a specific risk or vulnerability that the original control would have addressed. Compensating controls work by providing an equivalent level of protection, often through a different method or technology. They are crucial for maintaining a robust security posture and adapting to unique operational constraints or legacy system limitations. For instance, if strong encryption for data at rest is not feasible, implementing rigorous access controls and audit logging for that data could serve as a compensating control. This differs from a preventative control, which aims to stop an incident before it happens, whereas a compensating control addresses a gap left by a missing or ineffective preventative measure. Understanding compensating controls is essential for cybersecurity certifications like Security+, CySA+, and CISSP.