What is a corrective control?
A corrective control acts after an event to reduce its impact and bring things back to normal. Where a preventive control tries to stop an incident and a detective control reports it, a corrective control does something about it: it removes the threat, repairs what was damaged or restores what was lost.
Examples of corrective controls
- Restoring files or a server from backup.
- Reimaging an infected workstation.
- Antivirus quarantining a malicious file, or EDR killing a process and isolating the host from the network.
- Disabling a compromised account and resetting its password.
- Patching the vulnerability an attacker just used.
- A fire suppression system putting out a fire.
- On the managerial side, a corrective action plan written after an audit finding.
Example: a ransomware alert from start to finish
An accounts clerk opens a malicious attachment at 11:40 p.m. on a Friday. Within seconds, the endpoint agent notices files being renamed with a new extension. That observation is detective. The agent then kills the process and cuts the laptop off the network, and on Monday the help desk restores the clerk's files from the previous night's backup. Those actions are corrective. When one tool both alerts and remediates, the verb in the scenario decides which type a question means: alerted the SOC is detective, and rolled back the encrypted files is corrective.
Timing changes the type
The same activity can be preventive or corrective depending on when it happens. Routine monthly patching before anyone has exploited a flaw is preventive. Patching a web server because an attacker used that flaw last night is corrective. Backups follow the same logic: the job runs beforehand, but its security function is restoring data after a loss, so backups are classed as corrective.
Corrective controls depend on preparation. A backup that has never been test-restored may fail on the day it is needed, and an incident response plan nobody has rehearsed slows recovery when time matters most.
Corrective vs. recovery and compensating controls
Some frameworks list recovery as a separate control type for bringing systems fully back into service. Security+ SY0-801 does not, so restoring systems and data counts as corrective. The more dangerous confusion is with compensating controls. A corrective control responds to an incident that happened. A compensating control fills a gap where a required control can't be used, whether or not anything has gone wrong. Moving a laptop that is spreading malware onto a quarantine VLAN is corrective; placing an unpatchable controller on its own VLAN as a standing safeguard is compensating.
Corrective control on the CompTIA Security+ exam
Control types belong to SY0-801 objective 1.1. Words such as restore, recover, remediate, repair, contain, quarantine and roll back point to corrective. The usual distractors are detective, when the scenario's tool also raised an alert, and compensating, when the scenario mentions isolation. Ask whether anything was changed after the event; if it was, the control is corrective. Category is a separate question: a backup restore is technical, a help desk resetting a compromised account is operational and fire suppression is physical, yet all three are corrective in type.