Which of the following is true regarding compensating controls?

A compensating control is not necessary if all other PCI DSS requirements are in place

A compensating control must address the risk associated with not adhering to the PCI DSS requirement

An existing PCI DSS requirement can be used as compensating control if it is already implemented

A compensating control worksheet is not required if the acquirer approves the compensating control