Compensating control

A measure that holds the line on a risk while a gap remains open (for example, human review of a model's outputs until a stale evaluation is re-run). A sound compensating control names three things: the exact boundary of the risk it covers, the trigger that forces human escalation, and who signs off and how often. Named in a flag so that a disclosed gap comes with an interim safeguard rather than an open exposure.

A structural or runtime control built at a boundary you do control specifically to offset residual risk from a safeguard you cannot verify or modify directly, such as a vendor agent's undisclosed internal safeguards (Section 3M). A compensating control does not require trusting the unverifiable part; it bounds the consequence if that part fails.

A mitigation applied at one component (for example, narrower tool permissions) to reduce the risk created by an unresolved gap at another component (for example, a protocol with no provenance check). Reduces exposure without claiming to fix the root cause.

A control an organization operates on its own side of a boundary with a third-party agent or system, added specifically to close a gap the third party's own controls do not cover, used when a vendor cannot or will not meet a required control depth directly.