Comprehensive and Detailed Explanation (aligned to ISACA CRISC guidance) Multi-factor authentication (MFA) added to an FTP connection is typically used as a compensating control when the primary mechanism (e.g., legacy FTP protocol without strong encryption or modern authentication support) cannot be fully replaced in the short term. A compensating control provides an alternative safeguard that meets the intent of a required control and affords comparable or enhanced protection. MFA strengthens authentication and reduces the likelihood of unauthorized access, thereby compensating for inherent weaknesses in the underlying protocol or environment. Detective controls identify events after they occur (e.
g., logging, monitoring). Deterrent controls discourage attempts (e.g., warning banners, visible cameras).
Corrective controls act after an event to restore the system (e.g., backups, patches). Here, MFA is proactive, implemented in place of or in addition to the required stronger protocol, making "compensating" the most appropriate category.
Reference: CRISC Review Manual - Risk Response and Mitigation (control types and compensating controls).