Overview
When an incident has happened, you need controls that limit the damage and restore normal operation. Corrective controls act after detection to contain, repair, and recover. They are what turn a detected incident into a managed one rather than a disaster.
Learning objectives
- Define corrective controls (and related recovery/compensating controls).
- Give examples.
- See how corrective controls fit the incident lifecycle.
Core concept
A corrective control reduces the impact of an incident and helps return systems to a secure, working state. Closely related ideas:
- Recovery controls restore data or services (backups, disaster-recovery sites).
- Compensating controls are alternative safeguards used when the ideal control is not feasible (e.g. extra monitoring around a system that cannot yet be patched).
Examples of corrective/recovery controls: restoring from backup, isolating an infected host, applying an emergency patch, revoking compromised credentials, rebuilding a server from a known-good image.
How it works
Corrective controls target impact rather than likelihood. After a detective control raises an alert, corrective controls execute the response: contain (stop the spread), eradicate (remove the cause), and recover (restore service). Preparation makes these fast — tested backups and ready runbooks turn a chaotic scramble into a routine.
Practical example
Ransomware encrypts a file server (prevention failed; a detective control alerted the team). Corrective controls kick in: the host is isolated from the network (containment), the malware is removed and the vulnerability patched (eradication), and the data is restored from clean offline backups (recovery). Because backups were tested, the business is back within hours instead of paying a ransom.
Cybersecurity relevance
Corrective controls are the operational core of incident response (a later module). Their effectiveness is decided before the incident — by having tested backups, recovery plans, and clear procedures ready to go.
Common mistakes
- Untested backups that fail exactly when needed.
- No incident-response plan, so recovery is improvised and slow.
- Recovering without eradicating the root cause, leading to reinfection.
Key takeaways
- Corrective controls act after an incident to contain, eradicate, and recover, reducing impact.
- Recovery controls (backups, DR) and compensating controls are related forms.
- Their success depends on preparation done in advance — especially tested backups and plans.
Check your understanding
- Order these into containment, eradication, and recovery: restore from backup, isolate the host, remove the malware.
- Why must you eradicate the root cause before recovering, not after?