Compensating controls are an integral part of PCI DSS compliance.  It provides a method by which companies can flex the requirements of cardholder data security to match their unique business processes and security controls.  Rarely does a company meet every requirement in the exact way it is stated in the Security Audit Procedures (SAP).  Instead many leverage unique controls that both "meet the intent and rigor" and go "above and beyond" the requirement not directly met.

There are several steps that should be followed by companies seeking to implement compensating controls.  The first step is to identify whether compensating controls are needed.  Compensating controls should only be leveraged when necessary (in the face of legitimate technical or business constraints), with the primary goal being to meet the actual requirements as outlined in the PCI DSS.

Secondly, the organization mustunderstand the intent behind each requirement and use that to enumerate controls to address that intent.  The compensating control must be designed to mitigate the same risk, and to the same degree, that the specified control would do.

The next step in using a compensating control is to document the control. Use the compensating control appendices in the SAP to define the following elements - the constraint which precludes the use of the required control, the objective, the identified risk, and the compensating controls leveraged.

Lastly, the compensating controls that are going to be used should be reviewed and approved.  Before implementing any control its best to have it reviewed by a qualified third-party and then accepted by ones acquirer.

These steps should be repeated on an annual basis regardless of whether or not the original requirement will eventually be met.