Which Appendix name discusses compensating controls in PCI DSS?

Which Appendix name discusses compensating controls in PCI DSS?

• A. Appendix A
• B. Appendix B
• C. Appendix D
• D. Appendix E

Answer: (B)

Compensating controls come with their own section in the PCI DSS guidance, specifically named Compensating Controls. This appendix lays out when you can use compensating controls, the criteria you must meet to justify them, the documentation you need to provide, and how to validate that they effectively mitigate the risk. That direct naming and guidance make it the correct place to learn about compensating controls. Other appendices cover different topics and do not address compensating controls, so they don’t fit the question.

Compensating controls come with their own section in the PCI DSS guidance, specifically named Compensating Controls. This appendix lays out when you can use compensating controls, the criteria you must meet to justify them, the documentation you need to provide, and how to validate that they effectively mitigate the risk. That direct naming and guidance make it the correct place to learn about compensating controls. Other appendices cover different topics and do not address compensating controls, so they don’t fit the question.