Compliance Glossary

Also referred to as Alternative Controls, it is a set of security and privacy controls implemented by an organization in lieu of the NIST Special Publication 800-53 to mitigate risks and provide an alternative approach to achieving the same security objectives as primary controls. They are often used to reduce the impact of security breaches or data loss when standard controls are not functioning as intended or when you cannot implement primary security controls due to technical or operational limitations. Compensating controls should be appropriately documented and regularly reviewed to ensure their effectiveness.