PCI SSC publishes guidance on compensating controls and customized approach

Original title: PCI SSC Publishes New Guidance on Compensating Controls and the Customized Approach

The PCI Security Standards Council has released a new information supplement titled "PCI DSS v4.x: Guidance for Compensating Controls and the Customized Approach" to help organizations and assessors understand flexibility options in PCI DSS v4.x. The document clarifies two commonly misunderstood mechanisms: compensating controls, which provide alternative ways to meet security requirements when standard controls cannot be implemented, and the customized approach, which allows tailored solutions for specific business environments. This guidance was developed collaboratively with industry stakeholders including the Global Executive Assessor Roundtable and the Board of Advisors.

What changed

• PCI SSC releases new information supplement on compensating controls and the customized approach in PCI DSS v4.x, providing practical guidance to help assessed entities and assessors navigate flexibility options that are often misunderstood

Who is affected

Assessed entities implementing PCI DSS v4.x and qualified security assessors (QSAs) conducting PCI DSS assessments globally