A management, operational, and/or technical control (i.e., safeguard or countermeasure) employed by an organization in lieu of a recommended security control in the low, moderate, or high baselines that provides equivalent or comparable protection for an information system.
Sources:
NIST SP 800-30 Rev. 1
under Compensating Security Control
from
CNSSI 4009
NIST SP 800-39
under Compensating Security Control
from
CNSSI 4009
The management, operational, and technical controls (i.e., safeguards or countermeasures) employed by an organization in lieu of the recommended controls in the low, moderate, or high baselines described in NIST Special Publication 800-53, that provide equivalent or comparable protection for an information system.
Sources:
NIST SP 800-137
under Compensating Security Controls