A compensating control is a security mechanism that delivers equivalent protection when the targeted NIST SP 800-171 Rev 2 requirement cannot be implemented on the asset itself. Under CMMC Level 2, every Enduring Exception must be paired with a compensating control that is technically implemented, not just described on paper.
When compensating controls are required
CMMC maps Level 2 to the 110 controls in NIST SP 800-171 Rev 2. A defense contractor can invoke an Enduring Exception for an asset — typically a PLC, CNC, HMI, or other specialized OT equipment — that cannot natively satisfy a given control. The exception documents the asset's incapacity. It does not remove the control obligation. A compensating control closes the gap.
The Affirming Official who signs the assessment is certifying that each compensating control produces verifiable evidence equivalent to the original requirement. A C3PAO will ask for that evidence during the assessment. Control language on paper without a working technical implementation is not sufficient.
What the compensating control must do
Four tests for an acceptable compensating control:
- Equivalent risk reduction. The control must mitigate the specific risk that the unimplemented requirement addresses — not a similar risk, the same one.
- Technically implemented. The mechanism is deployed, not planned. Configuration is exportable as evidence.
- Verifiable. Logs, policy exports, or network captures demonstrate the control operating.
- Documented in the SSP. The asset, the uncovered control, the compensating mechanism, and the evidence path are all written down.
Proxy-layer enforcement for OT
Most OT compensating controls shift enforcement from the asset to a network-layer proxy. A CNC controller that cannot perform MFA is protected by an identity gateway that enforces MFA at the network boundary before any session reaches the machine. A legacy controller that cannot generate audit logs is protected by session logging at the proxy. A device that speaks plaintext Modbus is protected by encrypted transport terminating at the proxy inside a micro-DMZ.
The pattern is consistent: the asset remains unchanged, the compensating control runs elsewhere, the SSP documents the architecture.
Related terms
- CMMC Enduring Exception
- Specialized Asset (CMMC)
- Affirming Official (CMMC)
- CMMC Shared Responsibility Matrix
- NIST SP 800-171
Access Gate connection
Access Gate is commonly used to host compensating controls for OT assets that qualify for Enduring Exceptions — enforcing identity, audit, and encryption at the network boundary rather than modifying the asset. See the CMMC Shared Responsibility Matrix for per-control coverage.
