Jack has submitted his physical security program solutions to management for approval. One of the responses to his submission was that the company could notafford to employ security guards as he recommended. What type of control should Jacklook at implementing?

A.
Directive

B.
Physical

C.
Compensating

D.
Administrative

Explanation:
Any control can really end up being a compensating control. An organization would choose a compensating control if another control is too expensivebut protection is still needed. For example, a company can’t afford a security guardstaff, so they erect fences, which would be the compensating control. Another reason to use a compensating control is business needs. If the security team recommends closing a specific port on a firewall, but the business requires that service to be available to external users, then the compensating control could be to implement an intrusion prevention system (IPS) that would closely monitor the traffic coming in from that port.