Free Preparation Discussions
MENU
PCI QSA_New_V4 Exam - Topic 3 Question 18 Discussion
Topic #: 3
Which of the following is true regarding compensating controls?
Compensating Controls Definition and Purpose
A compensating control is an alternate measure that satisfies the intent of a specific PCI DSS requirement and provides an equivalent level of security.
The rationale and risk mitigation must be explicitly documented using the Compensating Control Worksheet (CCW).
Mandatory Documentation
PCI DSS v4.0 mandates the use of a CCW when implementing compensating controls. This applies regardless of acquirer approvals.
The CCW requires detailed documentation including:
Constraints preventing the original requirement from being implemented.
Justification for the compensating control.
Description of the control and evidence of its effectiveness.
Using Existing Requirements
If an existing PCI DSS requirement (e.g., Requirement 5 for antivirus) is already implemented and can mitigate the risks of not meeting another requirement, it may qualify as a compensating control.
Approval and Review Process
QSAs must validate the implementation, effectiveness, and appropriateness of compensating controls during the assessment process
Laine
1 day agoBerry
20 days agoCarri
25 days agoAnnette
1 month agoGilbert
1 month agoDong
1 month agoRochell
2 months agoBelen
2 months agoAshlee
2 months agoHaydee
2 months agoSherell
2 months agoPete
2 months agoKaycee
3 months agoLoren
3 months agoElin
3 months agoMickie
3 months agoJoesph
4 months agoLettie
4 months agoPatti
4 months agoGregoria
3 months ago