A compensating control is a security mechanism that gives equivalent protection when a NIST SP 800-171 requirement cannot be implemented on the asset itself, for example MFA enforced at a network gateway in front of a PLC that has no login. Under CMMC, every Enduring Exception must be paired with one, and it has to be technically implemented, verifiable and written into the System Security Plan, not just described. The guide to CMMC exceptions and compensating controls for OT covers the four tests a compensating control must pass and the evidence a C3PAO asks for.
Back to Glossary
Compensating controlCMMC Level 2Enduring Exception
Compensating Control (CMMC)
1 min read
Other Terms
Affirming OfficialCMMC Level 2
Affirming Official (CMMC)
The Affirming Official is the senior company representative who certifies CMMC compliance in SPRS under penalty of the False Claims Act, personally accountable for the accuracy of every control statement.
CMMC Level 2Advanced Cyber Hygiene
CMMC Level 2
CMMC Level 2 is the certification tier for defense contractors that handle Controlled Unclassified Information, requiring the 110 security controls of NIST SP 800-171 and, for most contracts, a third-party C3PAO assessment.
Specialized assetCMMC Level 2
Specialized Asset (CMMC)
A specialized asset is a CMMC category for equipment that handles CUI but cannot meet all 110 NIST SP 800-171 controls, covering IoT, OT, government-furnished property, restricted systems, and test equipment.
