Controls don’t eliminate risk; they shift how you measure and manage it. And let’s be honest: compensating controls don’t reduce the total volume of work; they shift where the work happens.

Though a few large merchants fail to achieve compliance with the Payment Card Industry Data Security Standard, many rely on alternative compensating controls to comply, according to a report released ...