A compensating control is MOST appropriate when:
Management wants to increase the number of controls.
A vulnerability is identified.
Existing controls are inadequate.
A key control is already in place and operating effectively.
A compensating control addresses risk when the primary control cannot meet the required objectives due to practical constraints.
Submit