
The compensating-control trap
"We encrypt it and sign a DPA" is a real control. It is not equivalent to processing that never leaves the building — because compensating controls recur, are exercised at arm's length, and produce assurance rather than evidence.

