Free Preparation Discussions
MENU
PCI QSA_New_V4 Exam - Topic 2 Question 27 Discussion
Topic #: 2
Which of the following is true regarding compensating controls?
Compensating Controls Definition and Purpose
A compensating control is an alternate measure that satisfies the intent of a specific PCI DSS requirement and provides an equivalent level of security.
The rationale and risk mitigation must be explicitly documented using the Compensating Control Worksheet (CCW).
Mandatory Documentation
PCI DSS v4.0 mandates the use of a CCW when implementing compensating controls. This applies regardless of acquirer approvals.
The CCW requires detailed documentation including:
Constraints preventing the original requirement from being implemented.
Justification for the compensating control.
Description of the control and evidence of its effectiveness.
Using Existing Requirements
If an existing PCI DSS requirement (e.g., Requirement 5 for antivirus) is already implemented and can mitigate the risks of not meeting another requirement, it may qualify as a compensating control.
Approval and Review Process
QSAs must validate the implementation, effectiveness, and appropriateness of compensating controls during the assessment process
Markus
11 hours agoRomana
6 days agoLenna
11 days agoJesusa
16 days agoNovella
21 days agoLetha
26 days agoMyra
1 month agoJohnna
1 month agoCaren
1 month agoJennie
2 months agoDominic
2 months agoNydia
2 months agoSalena
2 months agoNathan
2 months agoMabel
2 months agoChantell
3 months agoJohnetta
3 months agoTitus
3 months ago