Which one of the following statements is not true about compensating controls under PCI DSS$?$

Group of answer choices

A$.$ Controls used to fulfill one PCI DSS requirement may be used to compensate for the absence of a control needed to meet another requirement.

B$.$ Controls must meet the intent of the original requirement.

C$.$ Controls must meet the rigor of the original requirement.

D$.$ Compensating controls must provide a similar level of defense as the original requirement.