This is a theoritical question. There are preventive controls and corrective controls. So, is Backup a corrective control or a preventive control? There are mixed answers and mixed explainations. (CISA EXAM)
It isn't a control until it can be used and the only benefit is corrective, it does not prevent the media loss, it just helps fix the media loss.
Who cares that it needs to be implemented beforehand, and operational costs are incurred beforehand.
All other tools need to be implemented before they can be used, except maybe forensics.
That said, you need to "Channel" whoever wrote the exam and I am not CISA myself, RTFM.
It's a corrective control in ISMS (Information Security Management Systems).
Controls serve a security objective and modify either the likelihood of occurrence or the amount of damage done.
A backup does not prevent the loss of data due to an attack or a technical failure. It just reduces the amount of damage.
Preventive controls reduce the likelihood, corrective controls reduce the damage.
When you go through risk analysis, you have a vulnerability that is met by a threat, the risk emerges. If the threat and vulnerability match, damage occurs. The backup reduces this damage but does not modify likelihood.
The loss of data is an outcome of the event which risk is measured.
imo, It's both.
Obviously a backup doesn't get used until a restore is needed (corrective), but unlike a lot of other corrective controls(e.g. blocking a domain that's attacking you), it has to be implemented before the fault occurs(preventative).
I would say that the process of creating backups is a preventative control, and the process of restoring from backups is a corrective control.
Given that most people think of making backups/ 'backing up' when you ask about backups, I'd answer "preventative" in general.
A corrective control is an aftermath of detective and preventive. You can only restore from a backup after an incident, for example. Issuing a warning or firing an employee is a corrective control, after detecting fraud, for example.
I'm writing an answer to clarify the issue with an example, although others have already given the correct answer: it's corrective. But I see there are others who think it's both preventive and corrective. Let's see:
Threat: the hard disk fails, or an attacker deletes your data.
Damage: data loss, with an impact on availability or integrity.
How do backups prevent these kinds of incidents? Whether you make backups or not, the probability of the incidents won't change: the hard disk will still fail with the same probability, and the same goes for the attacker. So backups can't be a preventive control.
The confusion comes from the fact that backups need to be made before the incident, so in colloquial language we can say that "we make backup to prevent data loss". But for example, an intrusion detection system needs to be installed and configured in advance too, before the incident, yet that doesn't mean it is a preventive control (it's a detective control). Even though colloquially you could even say that you install an IDS to "prevent" an attacker from causing too much damage, by detecting the intruder as soon as possible.