Slightly modifying a security standard to meet a practical organizational need. Compensating controls are a form of tailoring. Must be documented, explained to the auditor, and usually requires regulatory approval.
Want to actually apply concepts like this instead of just reading definitions?
Practice free on Zamlom