Technical compensating controls such as network monitoring and application whitelisting protect unpatched OT systems
Compensating controls including monitoring focused on unpatchable devices apply A.8.16's monitoring discipline to production systems that cannot be patched directly.
Technical compensating controls, network isolation, application allowlisting, targeted monitoring, protect unpatchable production systems the way A.8.8 expects when normal patching cannot apply.
Network isolation, application allowlisting and targeted monitoring for unpatchable production systems are compensating configuration controls where A.8.9's normal baseline-and-patch approach cannot apply.