compensating controls

{
  "id": "MLC-T-CYB-000789",
  "term": "compensating controls",
  "field": "Cybersecurity",
  "definition": "1. Alternative controls to the normative controls for the assessed and selected xALs of an organization based on that organization’s mission, risk tolerance, business processes, risk assessments, and considerations for the privacy, usability, and customer experience of the populations served by the online service.\n\n2. The security and privacy controls implemented in lieu of the controls in the baselines described in NIST Special Publication 800-53 that provide equivalent or comparable protection for a system or organization.\n\n3. The security and privacy controls employed in lieu of the controls in the baselines described in NIST Special Publication 800-53B that provide equivalent or comparable protection for a system or organization.",
  "see_also": [
    "controls"
  ],
  "references": [
    "NIST SP 800-63-4",
    "NIST SP 800-37 Rev. 2",
    "NIST SP 800-53 Rev. 5; NIST SP 800-53B; NIST SP 800-53A Rev. 5 from NIST SP 800-53B",
    "NIST CSRC Glossary"
  ],
  "url": "https://mlchart.com/terminology/cybersecurity/compensating-controls/"
}