PCI SSC publishes guidance on compensating controls and customized approach
PCI SSC released guidance clarifying the differences between compensating controls and the customized approach under PCI DSS v4.x. It emphasizes documentation quality and assessor independence.
- Framework
- PCI DSS
- Who it concerns
- Assessed entities and assessors navigating PCI DSS v4.x requirements.
What changed?
Each point with the sentence from the source that says it.
Compensating controls apply when an organization cannot meet a defined requirement due to a legitimate technical or business constraint, while the customized approach is for entities that choose to meet a requirement differently by satisfying its stated Customized Approach Objective through a novel control design.
Compensating controls apply when an organization cannot meet a defined requirement due to a legitimate technical or business constraint. The customized approach is for entities that choose to meet a requirement differently by satisfying its stated Customized Approach Objective through a novel control design.
The customized approach is designed for entities with robust risk management practices, including dedicated risk management functions and the internal capacity to design, implement, document, test, and maintain their own controls over time.
The customized approach is not universally appropriate. It is designed for entities with robust risk management practices - including dedicated risk management functions and the internal capacity to design, implement, document, test, and maintain their own controls over time.
Entities are encouraged to prepare clear, complete, and well-structured documentation for their compensating or customized controls; incomplete documentation may prevent an assessor from validating that a control is in place and operating effectively.
Entities are encouraged to prepare clear, complete, and well-structured documentation for their compensating or customized controls. If an entity’s documentation is incomplete, an assessor may be unable to validate that a control is in place and operating effectively.
Assessor independence must be preserved: the assessed entity is responsible for the development, implementation, and maintenance of the control, and an assessor involved in designing or implementing a control cannot also assess that same control.
Assessor independence is a fundamental tenet of PCI DSS assessments and applies equally to compensating controls and customized implementations. The assessed entity is responsible for the development, implementation, and maintenance of the control. An assessor involved in designing or implementing a control cannot also assess that same control.
Entities can use compensating controls for some system components and the customized approach for others, even for the same PCI DSS requirement, but each instance must be documented separately and satisfy the applicable objectives.
Entities can use compensating controls for some system components and the customized approach for others - even for the same PCI DSS requirement. Each instance must be documented separately, and each must satisfy the applicable objectives.
Which policies should you review?
Suggested from the change above. Check the source before you edit.
- Information Security Policy
Review the Information Security Policy to clarify the distinction between compensating controls and the customized approach and to define documentation requirements for each.
- Vendor & Third-Party Management Policy
Update the Vendor & Third-Party Management Policy to ensure assessor independence is maintained when third parties are involved in control design or implementation.