Compensating control
In one sentence
An alternative safeguard you put in place when you can't meet a requirement the standard way, and disclose honestly.
When a control isn't feasible (say, an old system that can't run modern security), a compensating control is a different safeguard that reduces the same risk: isolating that system, extra monitoring. Disclosed accurately, underwriters can price it; hidden, it becomes a misrepresentation.
Why it's on your cyber insurance application
The honest alternative to a false 'yes': the close-or-disclose path.
How the Readiness Check scores it
The free Check asks the same question a carrier will. Here it is, why it's asked, and the fix if today's honest answer is no. The full application question list has the rest.
Patching & vulnerabilities
Do you run any systems that no longer receive security updates (end-of-life)?
Why carriers ask: Unpatched, internet-facing software is now a leading initial-access vector. Applications ask about patch cadence and end-of-life systems specifically.
If the answer is no: Replace what you can; isolate what you can't (separate VLAN, no internet). Either path turns a 'no' answer into a defensible one.
The written evidence carriers accept
A “yes” on the application needs a document behind it. In the Readiness Pack, those documents are:
Related terms
Would you pass this question today?
The free Readiness Check scores you across the ten control domains carriers probe, in five minutes, no email required for the score.