Which of the following control types is focused on identifying vulnerabilities and weaknesses in systems and addressing them?

Corrective controls are implemented to remediate issues after a vulnerability or incident has been identified. Their primary focus is on "addressing" the weakness to restore the system to a secure state. This includes actions such as applying software patches, reconfiguring security settings, or restoring data from backups. While detective controls are responsible for the "identifying" phase, corrective controls are specifically designed for the subsequent action of fixing the identified problem.

A. Preventive controls are proactive measures, like firewalls or access policies, designed to stop security incidents before they happen, not to fix existing flaws.

B. Compensating controls are alternative safeguards used only when a primary control is not feasible; they do not focus on identifying and fixing vulnerabilities directly.

C. Detective controls, such as intrusion detection systems or log monitoring, are used only to identify and alert on vulnerabilities or incidents, not to remediate them.

1. National Institute of Standards and Technology (NIST). (2020). Special Publication (SP) 800-53, Revision 5: Security and Privacy Controls for Information Systems and Organizations. Page 13. The document defines corrective controls as actions taken to "correct and reduce the impact of an incident." The control family SI-2 FLAW REMEDIATION further details the process of identifying and correcting system flaws.

2. Santos, O., Stuppi, J., & Pirc, J. (2017). CCNA Cyber Ops SECFND 210-250 Official Cert Guide. Cisco Press. Chapter 1, "Cybersecurity and the Security Operations Center," Section: "Security Controls." This official Cisco publication defines corrective controls as those that "reduce the effect of an attack," which includes patching vulnerabilities that have been discovered.

3. Wilson, M., & Hash, J. (2003). NIST Special Publication (SP) 800-61: Computer Security Incident Handling Guide. Section 2.3.3, "Post-Incident Activity." This guide discusses corrective actions as a critical part of the incident response lifecycle, which involves "addressing the cause of the incident" (e.g., patching a vulnerability).