Risk Mitigation

Applies to. PCI DSS v4.0.1 uses mitigate in a few concrete places rather than as a programme: security features must be defined so the risk of insecure services, protocols and ports in use is mitigated (Requirements 1 and 2), software must be engineered to prevent or mitigate common software attacks (Requirement 6), and the incident response plan must set out containment and mitigation activities for different incident types (Requirement 12). Where a requirement cannot be met as written, a compensating control is the standard's formal way of mitigating the risk of the deviation.