Which of the following describes compensating controls?

Which of the following describes compensating controls?

• A. Controls that prevent all attack attempts
• B. Controls used as alternatives when primary controls fail
• C. Controls that enhance system performance
• D. Controls that are mandatory regardless of the situation

Answer: (B)

Compensating controls are specifically designed to provide alternatives when the primary controls are either insufficient or have failed entirely. They come into play as a backup or temporary measure to provide similar protection. For instance, if a certain security system is expected to prevent unauthorized access but fails, a compensating control like additional monitoring could be implemented to mitigate the risk. This approach allows organizations to maintain a level of security even when their primary measures are lacking. In essence, compensating controls help in maintaining security effectiveness by filling the gaps left by primary controls.

Compensating controls are specifically designed to provide alternatives when the primary controls are either insufficient or have failed entirely. They come into play as a backup or temporary measure to provide similar protection. For instance, if a certain security system is expected to prevent unauthorized access but fails, a compensating control like additional monitoring could be implemented to mitigate the risk. This approach allows organizations to maintain a level of security even when their primary measures are lacking. In essence, compensating controls help in maintaining security effectiveness by filling the gaps left by primary controls.