Which term refers to a security control that is used when a primary control fails to meet security requirements?

Which term refers to a security control that is used when a primary control fails to meet security requirements?

• A. Deterrent
• B. Directive
• C. Preventive
• D. Compensating

Answer: (D)

This item is about a compensating control, which is an alternative security measure put in place when the primary control cannot meet security requirements. The goal of a compensating control is to provide equivalent or acceptable protection by addressing the same risk in a different way when the original control isn’t feasible, fails, or is not allowed by constraints such as cost, technology, or regulation. Think of it as a substitute that achieves a similar level of risk reduction. For example, if a policy requires a strong access control mechanism but the system can’t support it due to technical limitations, you might implement compensating measures like enhanced logging, tighter network segmentation, stricter access reviews, or additional monitoring to still meet the overall security objective. Deterrents discourage attackers but don’t provide an active, operational protection baseline if an attack occurs. Directives are policies or instructions, not controls themselves. Preventive controls aim to stop incidents from happening, but the term we use when a primary control isn’t possible and an alternative is needed is compensating control.

This item is about a compensating control, which is an alternative security measure put in place when the primary control cannot meet security requirements. The goal of a compensating control is to provide equivalent or acceptable protection by addressing the same risk in a different way when the original control isn’t feasible, fails, or is not allowed by constraints such as cost, technology, or regulation.

Think of it as a substitute that achieves a similar level of risk reduction. For example, if a policy requires a strong access control mechanism but the system can’t support it due to technical limitations, you might implement compensating measures like enhanced logging, tighter network segmentation, stricter access reviews, or additional monitoring to still meet the overall security objective.

Deterrents discourage attackers but don’t provide an active, operational protection baseline if an attack occurs. Directives are policies or instructions, not controls themselves. Preventive controls aim to stop incidents from happening, but the term we use when a primary control isn’t possible and an alternative is needed is compensating control.