PCI DSS Compensating Controls vs. Customized Approach

is a conversation we have a few times isn't it

yeah and and it's kind of timely right so the standard recently issued because i think it's such a misunderstood topic even i think probably around assessors as well that they issued this informational supplement, I think.

Yes, it's the guidance for compensating controls and the customized approach.

It came out in June.

Yeah, and I haven't seen any customized approaches done because it's relatively rare, but certainly compensating controls, you and I have both seen them over the years and we've seen some that have been done and we look at them and go, can that be used for that? Because you think it can't because The old compensating control approach that has existed since, I don't know what version, probably first version or second version, certainly the early days.

It's there in case you can't meet a requirement for some reason.

So it's allowing you literally to compensate.

So if there's a reason why you cannot do a requirement, and it's quite strict on the types of reason that are allowed to be used, compensating controls.

Whereas a customized approach is a relatively new thing for version four, and that's more about saying, well, I can meet the requirement, but I want to do it in an unconventional way, or I want to do it in a way that isn't the traditional way the standard expects you to do that requirement.

So one is about flexibility, but the other is about trying to allow you to do something different should constraints be in your way from actually meeting the requirements.

They're both quite different things to fit quite different scenarios.

Yeah, and I think, like, compensation control is, you cannot do something because of legal, technical constraints, whatever it is.

And when you go to the customized approach, you choose not to do something.

And then you do something else instead.

So it should be relatively simple.

However, I think the bigger challenge is when you run into some sort of problem with a client during the assessment and it's like, okay, let's just do a compensating control.

And then there's sometimes it's not an option

because...

It's not supposed to be a fallback.

It's not supposed to be, oh, we did something wrong.

Let's fall back onto this.

It's supposed to be a considered decision to say, well, we can't do this.

So we're going to do something else instead.

And the other way I see it is both the compensate control and the customer's approach should do whatever the original requirement was intending you to do but i feel like compensating controls at a you should achieve the whatever the preforma did whereas a customized validation tends to go above and beyond what the original account was tends to be if you like better for once of a maybe a subjective work but it tends to be a more advanced or more cutting edge way of dealing with the problem that the requirement is trying to address.

Whereas composite and control is, well, we can't do that.