Which statement is NOT a criterion for compensating controls?

Which statement is NOT a criterion for compensating controls?

• A. They must meet the intent and rigor of the original PCI DSS requirement
• B. They must provide a similar level of defense
• C. They must be above and beyond other PCI DSS requirements
• D. They do not need to be above and beyond other PCI DSS requirements

Answer: (D)

When you can’t meet a PCI DSS requirement, compensating controls are alternative measures that must achieve the same level of protection as the original control. They work by preserving the security goal of the requirement even though the exact control wasn’t feasible. They must reflect the intent and rigor of the original requirement, meaning they should address the same risk with an approach that matches how strong the original control would have been. They also have to provide a similar level of defense, not a weaker substitute, so the overall protection remains equivalent. Additionally, compensating controls should add protection beyond other PCI DSS requirements, rather than simply reusing existing controls. This extra strength is what makes them an acceptable substitute when the normal control can’t be implemented. Therefore, the statement claiming they do not need to be above and beyond other PCI DSS requirements is not a criterion for compensating controls.

When you can’t meet a PCI DSS requirement, compensating controls are alternative measures that must achieve the same level of protection as the original control. They work by preserving the security goal of the requirement even though the exact control wasn’t feasible.

They must reflect the intent and rigor of the original requirement, meaning they should address the same risk with an approach that matches how strong the original control would have been. They also have to provide a similar level of defense, not a weaker substitute, so the overall protection remains equivalent.

Additionally, compensating controls should add protection beyond other PCI DSS requirements, rather than simply reusing existing controls. This extra strength is what makes them an acceptable substitute when the normal control can’t be implemented.

Therefore, the statement claiming they do not need to be above and beyond other PCI DSS requirements is not a criterion for compensating controls.