An organization wants to implement compensating controls because a required technical control is not feasible. What must the compensating control demonstrate?
-
A
It must be cheaper than the original control
-
B
It must provide equivalent protection to the original required control
-
C
It must be approved by a third-party auditor before use
-
D
It must be temporary and replaced within 90 days