📖 What is Corrective Control?
Corrective Control is a security measure designed to remedy the cause of an error or a security incident and restore the system to a secure state. These controls act after a detective control has identified a problem.
"A classic example is restoring from a backup after a ransomware attack. It fixes the damage rather than preventing the attack from happening."
📚 Certification: Certified Information Security Manager (CISM)
🔑 What are the Key Concepts of Corrective Control?
- ▸ Corrective controls are reactive measures implemented after a detective control identifies a security incident to remediate damage and restore normal operations.
- ▸ The primary objective is to reduce the impact of an incident and return the system to a secure, functional, and known-good state.
- ▸ Common examples include restoring data from backups, patching a vulnerability after an exploit, or re-imaging a compromised workstation from a clean image.
- ▸ These controls are integral to the Incident Response and Disaster Recovery processes, focusing on the recovery and lessons learned phases of the lifecycle.
- ▸ Effective corrective controls often incorporate root cause analysis to ensure that the underlying vulnerability is eliminated, preventing the incident from recurring.
🎯 How does Corrective Control appear on the CISM Exam?
You may be asked to identify the control type in a scenario where an organization restores its database from a backup after a ransomware attack has encrypted production data, focusing on the action taken to return the system to a functional state.
A scenario might describe a sequence of events where an IDS alerts the team to a breach, and the team subsequently applies a critical patch to stop the leak. You must identify the patch as a corrective control.
Expect questions where you must distinguish between a detective control that identifies a failure and a corrective control that fixes the failure, specifically when selecting the best option to minimize downtime during an incident.
❓ Frequently Asked Questions
What is the difference between a corrective control and a compensating control?
Corrective controls fix a problem after it occurs to restore service. Compensating controls are alternative measures put in place when a primary preventive control cannot be implemented due to technical or business constraints.
Can a corrective control also be considered a preventive control?
Yes, when a corrective action—such as patching a vulnerability after a breach—is applied, it serves as a corrective control for the current incident and a preventive control for future similar attacks.