PCI DSS Compensating Controls for Requirement 3.4

“Compensating controls may consist of either a device or combination of devices, applications, and controls that meet all of the following conditions:

- Provide additional segmentation/abstraction (e.g., at the network layer)
- Provide ability to restrict access to cardholder data or databases based on the following criteria:
* Internet Protocol (IP) address/Media Access Control (MAC) address
* Application/service
* User accounts/groups
* Data type (packet filtering)
- Restrict logical access to the database
* Control logical access to the database independent of Active Directory or Lightweight Directory Access Protocol (LDAP)
* Prevent/detect common application or database attacks (e.g., Structured Query Language [SQL] injection)