PCI Data Security Standard Practice Test

Compensating controls are alternative measures you put in place when you cannot meet a PCI DSS requirement, and they must be documented in the ROC so there is formal justification, testing, and approval for their use. They must demonstrate they achieve the same security objective as the original control, not simply be added arbitrarily. They are not optional, nor do they replace all other controls; they’re specific accommodations that require evidence and validation within the assessment.