Compensating Control Worksheet (CCW)
PCIComplianceHubLast updated
The template, provided in PCI DSS Appendix C, used to document every compensating control. It records the constraint that prevents the requirement being met as written, the objective of the original requirement, the additional risk created by the deviation, the control put in place, how that control was validated, and how it will be maintained. A compensating control that is not documented in a completed worksheet and validated by the assessor at each assessment does not stand.