The use of multi-factor authentication (MFA) when applied to an FTP connection is an example...

Multi-factor authentication (MFA) added to an FTP connection is typically used as acompensating controlwhen the primary mechanism (e.g., legacy FTP protocol without strong encryption or modern authentication support) cannot be fully replaced in the short term. A compensating control provides an alternative safeguard that meets the intent of a required control and affords comparable or enhanced protection. MFA strengthens authentication and reduces the likelihood of unauthorized access, thereby compensating for inherent weaknesses in the underlying protocol or environment. Detective controls identify events after they occur (e.g., logging, monitoring). Deterrent controls discourage attempts (e.g., warning banners, visible cameras). Corrective controls act after an event to restore the system (e.g., backups, patches). Here, MFA is proactive, implemented in place of or in addition to the required stronger protocol, making “compensating” the most appropriate category.