Compensating control (PCI DSS)
An alternative safeguard allowed to stand in for a PCI DSS requirement when there is a legitimate reason the requirement can't be met as written.
The classic case is the legacy box that can't run anti-malware, doesn't support individual user accounts, or can't be patched without voiding the vendor's support contract. Rather than fall outside the standard, the company documents a substitute, such as strict network segmentation and monitoring around the machine, in a form called the Compensating Controls Worksheet.
The bar is higher than many hope. The control must meet the intent and rigour of the original requirement, go beyond what the standard already demands elsewhere, and rest on a genuine technical or business constraint rather than mere cost. It is re-examined at every annual assessment. A compensating control is a way of servicing a debt, not of writing it off.