Definition
A corrective control is a security measure designed to fix or mitigate a security incident or vulnerability after it has been detected. It functions by automatically or manually responding to an event, aiming to restore the affected system to its normal operational state or limit further damage. Implementing corrective controls is crucial for minimizing the impact of security breaches and ensuring business continuity. For instance, automatically isolating an infected endpoint from the network is a corrective control that prevents malware spread. This differs from detective controls, which identify that an incident has occurred, and preventive controls, which aim to stop incidents before they happen. Corrective controls are a key topic in cybersecurity certifications like CompTIA Security+, CySA+, and CISSP.