~/moritzsamrock_

Compensating Control

Compensating Control: Compensating measure that reduces risk when a primary control is not feasible. The term is relevant to the assessment and design of modern security architectures and should be applied within the specific technical and organizational context.

How it works and where it fits

Compensating Control is a preventive, detective, or corrective security control. Its effect depends on where it sits in the architecture, which data and decisions it processes, and how it might be bypassed. A control reduces a defined risk but rarely removes it completely, so it should be combined with additional layers of protection.

Practical security relevance

Before deployment, the objective, ownership, coverage, and expected behavior should be defined. Secure defaults, controlled exceptions, logging, and periodic effectiveness tests matter more than installation alone. Operational metrics should expose both blocked or detected activity and gaps, false alerts, and effects on legitimate business processes.

  • Risk AssessmentRisk AssessmentIdentifies, analyzes, and assesses threats, vulnerabilities, and impacts.: Identifies, analyzes, and assesses threats, vulnerabilities, and impacts.
  • Governance, Risk and ComplianceGovernance, Risk and ComplianceIntegrated approach to managing policies, risks, controls, and evidence.: Integrated approach to managing policies, risks, controls, and evidence.
  • Information Security Management SystemInformation Security Management SystemManagement system for the risk-based planning, implementation, and improvement of information security.: Management system for the risk-based planning, implementation, and improvement of information security.
  • Security PolicySecurity PolicyBinding directive regarding information security goals, responsibilities, and rules.: Binding directive regarding information security goals, responsibilities, and rules.

Related terms