Write a compensating control that an auditor would accept

applied · 75 min · Objective 1.1

Task

Take a real constraint on your own lab — something you genuinely cannot fix — and produce the compensating control documentation an auditor would accept: the control that cannot be applied, the risk it leaves, what you are doing instead, who accepted it, and when it is reviewed.

Steps

  1. Create the constraint honestly: on the Linux VM, install or configure a service that must listen on a port and that you will declare cannot be upgraded — a plain HTTP service on port 8080 serving a local file is enough. Record why it 'cannot' be replaced.
  2. State the control you should apply and cannot. Here it is transport encryption, or upgrading to a supported version.
  3. Implement compensating controls that address the SAME risk by another route: bind the service to the lab interface only, restrict source addresses with the host firewall to the single other VM you built, and enable logging of every connection.
  4. Write /tmp/compensating.md with the six headings an auditor looks for: the requirement, the control that cannot be applied, the reason, the residual risk, the compensating controls implemented, and the review date with a named owner.
  5. Prove each compensating control is actually in place, and paste the command output into the document under the control it evidences.
  6. Finally, state the expiry: the date by which the proper control will be in place or the decision retaken.

Verify

ss -ltn | awk '$4 ~ /:8080$/ {print "listening on "$4}'
sudo ufw status numbered 2>/dev/null | grep -c 8080 || sudo nft list ruleset | grep -c 8080
grep -icE "residual risk|review date|owner" /tmp/compensating.md
grep -oE "[0-9]{4}-[0-9]{2}-[0-9]{2}" /tmp/compensating.md | head -1

The first must show the service bound to the lab address rather than 0.0.0.0, which is the difference between a compensating control and a comment. The second must be non-zero: there is a rule naming the port. The third must be at least three — all the headings an auditor checks are present. The fourth must print a date; a compensating control with no expiry is the finding this lab is written to prevent.

Notes

The expiry is what separates a compensating control from an excuse. An organisation with forty undated compensating controls has not accepted forty risks, it has forgotten them — and that is exactly what a reviewer looks for.

This is an independent study companion for CompTIA Security+ SY0-701 and is not produced by or endorsed by CompTIA.