Compensating control
An alternative safeguard used when a required control cannot be implemented, providing comparable protection.
Legacy systems frequently cannot meet a requirement directly. A clinical device that cannot be patched might be isolated on its own network segment with strict filtering and monitoring instead.
Auditors accept these when the reasoning is documented, the alternative genuinely addresses the same risk, and it is reviewed periodically rather than becoming permanent by default.
Where this comes up
Compensating control sits inside our compliance and frameworks work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.