What it means
A compensating control addresses the security objective of a preferred control that cannot be implemented as intended. The reason might be a technical limitation, an operational constraint, or an incompatible system. The alternative needs a defensible relationship to the original risk; doing something convenient is not enough. Some compensating controls are temporary while a fix is prepared, while others remain necessary and require ongoing justification. Applicable standards may define specific acceptance requirements. The decision should identify the owner, remaining exposure, evidence of effectiveness, and conditions for review.
The idea at a glance / Risk
A useful restriction still needs comparable protection.
Compare the stated security goal with the paths a proposed substitute actually blocks and leaves open.
Synthetic ReportDesk S93 runs V93, whose name input can change query structure. Maya’s stated objective is to prevent that bypass on the selected search route. A tested bound-parameter V94 meets this selected goal in the lab, but production qualification is unavailable. Proposed P93 blocks the public route and permits maintenance access. Original V93 and the two customer rows remain.
READ THE PICTURE
Compare goal and evidence
P93 refuses the public probe before the service, yet permitted maintenance access still returns Lee and Sam for the same input. Sam’s ordinary read works. Maya has no basis here to declare the substitute comparable.
Keep in mindP93 reduces a particular opportunity but does not establish comparable protection for the stated goal. A maintenance path still reproduces the defect. Maya’s approval and residual-risk decision remain open; no compliance exception, production patch, risk acceptance or absence of earlier compromise is claimed.
Read the complete example
- Compare goal and evidence. P93 refuses the public probe before the service, yet permitted maintenance access still returns Lee and Sam for the same input. Sam’s ordinary read works. Maya has no basis here to declare the substitute comparable. On the fictional 30 September record, the public x' OR '1'='1 probe cannot reach S93, so that path does not evaluate the application. Maintenance reaches unchanged V93: GET /search returns HTTP 200 ["Lee","Sam"] for the same probe and ["Sam"] for Sam. In the separate V94 lab, the bound-parameter query returns [] for the literal probe and ["Sam"] for Sam. The service data stays unchanged. P93’s network behavior is an explicit controlled assumption, not a live firewall test. The modeled allowed route demonstrates why blocking one route does not remove the software weakness or automatically meet Maya’s stated objective. DEC93 retains the evidence while justification, operational impact and a qualifying owner decision remain unfinished. Other compensating controls can be lasting or temporary; their evidence and applicable acceptance requirements matter, not convenience.
P93 reduces a particular opportunity but does not establish comparable protection for the stated goal. A maintenance path still reproduces the defect. Maya’s approval and residual-risk decision remain open; no compliance exception, production patch, risk acceptance or absence of earlier compromise is claimed.
Diagram references: NIST SP 800-53 Rev. 5: functionality and assurance · NIST RMF Select Step: compensating controls, questions 33–34
AN ILLUSTRATIVE SCENARIO
A proposed restriction leaves a tested path open
ReportDesk S93 cannot yet deploy the qualified patch. Vera proposes P93 to block public access while retaining maintenance access. The public probe is refused before the application, but the permitted maintenance probe still changes the old query and returns both names. The ordinary Sloane search works. The restriction can reduce a particular opportunity, yet these records do not demonstrate protection comparable to the stated no-query-bypass goal. DEC93 and the owner’s decision remain open.
Put it to work
- Describe the missing control's purpose and the actual path to harm. Record why the preferred control is unavailable and whether a requirement permits an alternative or needs a formal exception.
- Select an alternative that addresses that path, assess its operational effects, and test it. Explain which threats it reduces and which remain possible rather than calling the substitute equivalent without evidence.
- Assign an accountable owner and review condition, such as a patch release or service change. Keep temporary deadlines visible and periodically reassess ongoing alternatives against current risk and obligations.
How to check your work
Exercise the relevant attack path safely in a test environment or controlled validation. Confirm the alternative interrupts that path, legitimate work remains possible, and the exception record accurately describes residual risk and the next review.
Connect the ideas
- Control
A process, configuration, or technology meant to reduce a named risk or detect a named failure.
- Residual risk
The risk that remains after implemented safeguards, including uncertainty in its assessment.
- Patch
A vendor or internal change that removes or reduces a vulnerability in running software.