Compensating Control Worksheet (CCW)
PCIComplianceHubLast updated
The template, provided in PCI DSS Appendix C, used to document every compensating control. It records the constraint that prevents the requirement being met as written, the objective of the original requirement, the additional risk created by the deviation, the control put in place, how that control was validated, and how it will be maintained. A compensating control that is not documented in a completed worksheet and validated by the assessor at each assessment does not stand.
Applies to. A worksheet is needed whenever an entity relies on a compensating control instead of meeting a requirement as written. Appendix B sets the conditions the control must satisfy and Appendix C is the worksheet that records it, one per requirement, validated by the assessor at each assessment. A worksheet cannot stand in for a requirement that could be met but has not been; it needs a constraint that prevents meeting the requirement as written.
Related. Compensating Controls, Controls Matrix, Customized Approach, Defined Approach, Legal Exception
Sources. PCI DSS v4.0.1 (June 2024)