Compensating Control

Updated 31 Jul 2026

•
def
- •
  a control used because the existing/optimal controls aren't sufficient — may be temporary — to prevent exploitation of a weakness
•
example
- •
  multi-factor authentication compensates for the risk of weak or stolen passwords
- •
  a firewall blocking a specific application instead of patching it; separation of duties; requiring simultaneous guard duties; a generator used after a power outage
•
related
- •
  Security Control Types
- •
  Authentication
•
cards
- •
  What does a compensating control do, and give an example?
  - •
    Substitutes for a control that isn't sufficient/available — e.g. MFA compensating for weak passwords

Linked references 5