Guide
PCI compensating controls, used properly
PCI compensating controls let you meet a requirement another way when a legitimate constraint prevents the stated approach. So they need a documented reason, a worksheet and the QSA's acceptance.
- We prepare, a QSA assesses
- Published price ranges
- Written estimate, no call
When PCI compensating controls apply
They apply when a legitimate technical or business constraint prevents meeting a requirement as written. For example, a legacy system that cannot support a setting.
However, they are not a shortcut. Because the alternative must meet the intent of the original requirement, the bar is high.
What the worksheet shows
Each compensating control needs a written worksheet. The table shows the usual parts.
| Part | Content |
|---|---|
| Constraint | Why the requirement cannot be met as written |
| Objective | The intent of the original requirement |
| Risk | The added risk from not meeting it |
| Control | What you do instead |
| Validation | How it was tested |
| Maintenance | How it is kept working |
PCI compensating controls check
Tick what is true for each one.
Your result appears here as you tick, so you can see what is still open.
Who accepts PCI compensating controls
The QSA reviews the worksheet and the evidence. Then it decides whether the control meets the intent. So involve the QSA early, before building the alternative.
Also expect the review to repeat at each assessment.
Keeping them under control
Track each one with an owner and a plan to remove the constraint where possible. Because compensating controls need renewing each year, a long list becomes expensive.
So the best plan often retires the constraint itself.
Common mistakes
Using a control that already exists for another requirement does not count. Also vague worksheets get rejected. Then the requirement stays open.
In addition, a compensating control that is not maintained turns into a finding.
Where Ashcroft helps
We assess whether a compensating control is realistic, draft the worksheet and prepare evidence for the QSA. Our gap analysis fee runs $8,000 to $40,000. We are not a QSA, so acceptance is the QSA's decision. The standard is in the PCI SSC document library.
Also tell your acquirer when a compensating control covers a significant requirement. Because acquirers set validation rules, they may want to know. So check their guidance early. In addition, keep the worksheet with the AOC file.
PCI compensating controls questions
Who approves PCI compensating controls?
The QSA, during the assessment.
Do PCI compensating controls last forever?
No. They are reviewed at each assessment.
Can SAQ merchants use PCI compensating controls?
Yes, with the worksheet attached to the SAQ.
Is cost a valid constraint?
Discuss it with your QSA. A pure cost preference is usually not enough.
Related guides
Handle PCI compensating controls properly
Describe the constraint you face. We reply with a written estimate, usually inside one business day.
Get my written estimate