This is a theoritical question. There are preventive controls and corrective controls. So, is Backup a corrective control or a preventive control? There are mixed answers and mixed explainations. (CISA EXAM)

  • It's both. It prevents data loss by correcting corruption and destruction. If you need to pick one for an exam, pick whatever the study guide says. – schroeder May 24 '18 at 19:23
  • I vote preventative. I don't buy the corrective arguments - seem rather contrived. – Jonathan May 24 '18 at 20:42
  • 2
    I'd say the confusion is from an ambiguous context. You're "preventing" the data lost", and you're "correcting" from an event that caused data loss. If this is a test question, it's a poorly thought out one. – Steve Sether May 24 '18 at 22:04

Corrective Control

It isn't a control until it can be used and the only benefit is corrective, it does not prevent the media loss, it just helps fix the media loss.

Who cares that it needs to be implemented beforehand, and operational costs are incurred beforehand.

All other tools need to be implemented before they can be used, except maybe forensics.

That said, you need to "Channel" whoever wrote the exam and I am not CISA myself, RTFM.

| improve this answer | |
  • 1
    from management perspective having backup also prevent business discontinuity. – elsadek May 25 '18 at 9:56
  • what if you only have the backups to pass an audit? :D – Angelo Schilling May 29 '18 at 20:19

It's a corrective control in ISMS (Information Security Management Systems).

Controls serve a security objective and modify either the likelihood of occurrence or the amount of damage done.

A backup does not prevent the loss of data due to an attack or a technical failure. It just reduces the amount of damage.

Preventive controls reduce the likelihood, corrective controls reduce the damage.

When you go through risk analysis, you have a vulnerability that is met by a threat, the risk emerges. If the threat and vulnerability match, damage occurs. The backup reduces this damage but does not modify likelihood.

The loss of data is an outcome of the event which risk is measured.

| improve this answer | |

imo, It's both.

Obviously a backup doesn't get used until a restore is needed (corrective), but unlike a lot of other corrective controls(e.g. blocking a domain that's attacking you), it has to be implemented before the fault occurs(preventative).

I would say that the process of creating backups is a preventative control, and the process of restoring from backups is a corrective control.

Given that most people think of making backups/ 'backing up' when you ask about backups, I'd answer "preventative" in general.

| improve this answer | |

A corrective control is an aftermath of detective and preventive. You can only restore from a backup after an incident, for example. Issuing a warning or firing an employee is a corrective control, after detecting fraud, for example.

Reference: Manage Risks with Preventive, Detective, and Corrective Controls

| improve this answer | |

I'm writing an answer to clarify the issue with an example, although others have already given the correct answer: it's corrective. But I see there are others who think it's both preventive and corrective. Let's see:

Threat: the hard disk fails, or an attacker deletes your data.
Damage: data loss, with an impact on availability or integrity.

How do backups prevent these kinds of incidents? Whether you make backups or not, the probability of the incidents won't change: the hard disk will still fail with the same probability, and the same goes for the attacker. So backups can't be a preventive control.

The confusion comes from the fact that backups need to be made before the incident, so in colloquial language we can say that "we make backup to prevent data loss". But for example, an intrusion detection system needs to be installed and configured in advance too, before the incident, yet that doesn't mean it is a preventive control (it's a detective control). Even though colloquially you could even say that you install an IDS to "prevent" an attacker from causing too much damage, by detecting the intruder as soon as possible.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.