SESK: Stuff Everyone Should Know · sesk.info/secplus-compensating-control
A system cannot use the normal required control. What do you call the alternative that gives comparable protection?
Compensating control, used in place of the one you cannot apply.
- A directive control
- A deterrent control
- A compensating control ✔
Why: Sometimes a legacy system cannot run the standard control. A compensating control, such as network isolation, delivers equivalent or comparable protection another way.
Huh, didn't know that: A nearly identical definition of compensating controls appears in NIST SP 800-37 Rev. 2, the Risk Management Framework guide.
A compensating control is like using a ladder when the elevator is broken. You still reach the floor.
Like this card?
References
Answer: A compensating control. Sometimes a legacy system cannot run the standard control. A compensating control, such as network isolation, delivers equivalent or comparable protection another way.
- NIST CSRC Glossary: compensating controls csrc.nist.gov/glossary/term/compensating_controls
controls employed in lieu of the controls in the baselines described in NIST Special Publication 800-53B that provide equivalent or comparable protection
Checked 2026-10-10.
Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.
More stuff everyone should know
Security & PrivacyWhich one of these is a security control category, rather than a control type?Security & PrivacyEncrypting a laptop's files mainly protects which part of the CIA triad?Security & PrivacyA file's hash value no longer matches after someone edits the file. Which CIA property was affected?
That's stuff everyone should know.