Compensating control
In one sentence
An alternative safeguard you put in place when you can't meet a requirement the standard way, and disclose honestly.
When a control isn't feasible (say, an old system that can't run modern security), a compensating control is a different safeguard that reduces the same risk: isolating that system, extra monitoring. Disclosed accurately, underwriters can price it; hidden, it becomes a misrepresentation.
Why it's on your cyber insurance application
The honest alternative to a false 'yes': the close-or-disclose path.
What this looks like in practice
You can't patch the machine running the equipment, so you put it on its own network segment, take remote access away from it, and write down who checks it. Then you tell the carrier exactly that. Underwriters price around known gaps every day. What they can't price is a gap they only learn about after a loss.
How the Readiness Check scores it
The free Check asks the same question a carrier will. Here it is, why it's asked, and the fix if today's honest answer is no. The full application question list has the rest.
Patching & vulnerabilities
Do you run any systems that no longer receive security updates (end-of-life)?
Why carriers ask: Unpatched, internet-facing software is now a leading initial-access vector. Applications ask about patch cadence and end-of-life systems specifically.
If the answer is no: Replace what you can; isolate what you can't (separate VLAN, no internet). Either path turns a 'no' answer into a defensible one.
The written evidence carriers accept
A “yes” on the application needs a document behind it. In the Readiness Pack, those documents are:
Related terms
Would you pass this question today?
The free Readiness Check scores you across the ten control domains carriers probe, in five minutes, no email required for the score.