Which Appendix provides a worksheet for defining compensating controls?

Which Appendix provides a worksheet for defining compensating controls?

• A. Appendix C
• B. Appendix B
• C. Appendix A
• D. Appendix D

Answer: (A)

When a PCI DSS requirement can’t be met, you can implement compensating controls if they provide an equivalent level of protection and are properly documented. The process to define and validate these controls is guided by a worksheet that captures the justification, scope, design, testing, and ongoing monitoring of the compensating controls to ensure they meet the original objective. In this documentation, that compensating controls worksheet is located in Appendix C, which is why Appendix C is the correct reference.

When a PCI DSS requirement can’t be met, you can implement compensating controls if they provide an equivalent level of protection and are properly documented. The process to define and validate these controls is guided by a worksheet that captures the justification, scope, design, testing, and ongoing monitoring of the compensating controls to ensure they meet the original objective. In this documentation, that compensating controls worksheet is located in Appendix C, which is why Appendix C is the correct reference.