2 cissp ® Official Study Guide Eighth Edition

Compensating Access Control
A
compensating access control
provides an alternative 
when it isn’t possible to use a primary control, or when necessary to increase the effective-
ness of a primary control. As an example, a security policy might dictate the use of smart-
cards by all employees, but it might take a long time for new employees to get a smartcard. 
The organization could issue hardware tokens to employees as a compensating control. 
These tokens provide stronger authentication than just a username and password. 
Access controls are also categorized by how they are implemented. Controls can be 
implemented administratively, logically/technically, or physically. Any of the access control 
types mentioned previously can include any of these implementation types. 
Administrative Access Controls
Administrative access controls
are the policies and pro-
cedures defi ned by an organization’s security policy and other regulations or requirements. 

---

584
Chapter 13 
■
Managing Identity and Authentication
They are sometimes referred to as management controls. These controls focus on personnel 
and business practices. Examples of administrative access controls include policies, proce-
dures, hiring practices, background checks, classifying and labeling data, security aware-
ness and training efforts, reports and reviews, personnel controls, and testing. 
Logical/Technical Controls
Logical access controls
(also known as
technical access 
controls
) are the hardware or software mechanisms used to manage access and to provide 
protection for resources and systems. As the name implies, they use technology. Examples 
of logical or technical access controls include authentication methods (such as passwords, 
smartcards, and biometrics), encryption, constrained interfaces, access control lists, proto-
cols, fi rewalls, routers, intrusion detection systems, and clipping levels.