[Autogenerated] popular myth of compensating controls that I used to come
across a lot is that you can only use it for a year.
That's not true.
They have to be re evaluated every year.
And maybe the circumstances have changed.
Uh,
and then there's there's one little piece at the end of the Compensated
control works you that talks about the maintenance right now,
this, I think, maybe applies to the anticipated duration of the control.
Part of what I want to see in a compensating control is okay.
How long do we have to keep this thing around before
you fix the underlying problem?
Right.
If you need a compensating control that last six weeks,
you know, until you can deploy some software upgrade,
you know, then I think the rigour of the control or,
you know,
the sort of allowance for making it every manual or
labor intensive process is reasonable.
If you need a compensating control for three years,
Yeah, you know, it better be pretty bulletproof and pretty automated and,
you know, pretty rigorous because you're leaving it around for a good,
long while.
I've had lots of discussions with curious eyes and merchants about
compensating controls when I was a car brand,
because often we were seen as an Arbit,
an arbitrator in the circumstances on my left,
you're saying that you know,
I had one merchant who wanted a three year compensating control
because that was the end of life of the mainframe,
and they were put in the new mainframe in that already bought the new mainframe.
It's gonna take three years to do the migration.
The USA was arguing when you cut a three year compensating control.
That's nonsense, isn't it?
You can have a three year compensation control you can write,
but every year that's going to be reevaluated.
Right and circumstances may change, right?
The threat landscape or the nature of the clients organization or
something like that might change and might precipitate the need for
some changes in that compensating control.
So, sure,
if you have a three year plan as part of something that for
which you write a compensating control, that's fine.
You can do that but expects there to be some checkpoints along the
way and maybe some necessary course correction,
right?
Don't expect that.
You just don't have to look at that again.
You do every year because, obviously,
you know the world changes rates and the threat landscape
changes exactly any other common traps in compensating
controls even blink off again.
It's It's so easy to do them badly, right?
Uh, and if you're operating out of what amounts toe,
you know, desperation or bad faith,
or just a desire to be done with your assessment and your compensating
controls are are sloppy or sort of ill conceived or half baked.
Uh, you know, then it's very easy.
T maybe try to put the squeeze on assessor and say,
Hey,
here's this compensating control sign off on its own And
then as soon as the assessment is done, then it just sort of falls down.