Society of Payment Security Professionals - Payment Security Blog

Documenting compensating controls

As many of you know by now, when meeting a PCI control requirement with a compensating control two things should happen:

1. The control should be marked “In Place” with a comment added that it is being met with a compensating control, and
2. The Compensating Control Worksheet should be completed.  This can be found in the Appendix of the Security Audit Procedures (SAP)

In order to determine the “Objective” one must first understand the intent of the original control.  What many people forget is that they want to know not only what the requirement intended, but also what it did NOT intend.  Sound confusing?  This is an advanced area of PCI compliance.

The intent only tells you the direction you want to go, but does not tell you the directions you want to avoid.  For example, if a requirement says you should not use FTP because it is susceptible to password sniffing you can either leverage:

• VLAN+ACLs, IP address restrictions, or tunnel it through FTP
• Truncate the card number or encrypt the payload with public-private key pairs

Both methods work to mitigate the risk, but from different control vectors.