$0.$ Which of the following is true regarding compensating controls?$$

A compensating control must be implemented and tested before it can be used in the PCI DSS assessment

Compensating controls are valid for three years

Compensating controls used in the previous year$$s assessment that are still in use do not need to be evaluated during this year$$s assessment

It is not necessary to complete a separate compensating control worksheet for each compensating control in ROC