According to Bower of Voltage, compensating controls are a way to skirt around compliance burdens. Some organizations will assume that because they have legacy systems they cannot encrypt or tokenize stored card data in a database or application. Many organizations don’t do enough to map their data flows for cardholder data to find out the whats, wheres, hows and whys of what’s stored. Many still do not do it right, says Todd Thiemann, senior director of product marketing for Vormetric.”]
Source: https://www.darkreading.com/compliance/top-10-pci-compliance-mistakes