SSCP - Security Concepts and Practices - Compensating controls