A transit agency cannot yet replace an end-of-life ticket kiosk operating system, so it isolates the kiosk VLAN and adds extra monitoring. Which control type best describes those alternate safeguards?
Select an answer to reveal the explanation.
Short Explanation
When you cannot buy the perfect lock yet, you put a camera on the hallway and move the valuables to a tougher room — that workaround is a compensating control. Isolating the crusty kiosk and watching it harder fills the gap until replacement day.
Full Explanation
Compensating controls provide alternate or additional safeguards when a preferred primary control cannot be implemented yet due to cost, legacy constraints, or other limitations. Segmenting an end-of-life kiosk and increasing monitoring compensate for the inability to immediately upgrade or replace the OS. Compensating does not mean the risk is zero; it means residual risk is managed until the preferred control is achievable. Directive, corrective, and physical labels do not fit this alternate-mitigation pattern.