Study. uk . com
  1. Home
  2. All questions
  3. Question 320

CISM study material · question 320 of 1000

How does IR 8286 define a corrective control?

  1. One that dissuades a threat actor from acting
  2. One that provides warning of a successful or attempted threat event
  3. One that reduces or eliminates specific instances of a vulnerability before it can be exploited
  4. One that reduces exposure by offsetting the impact of consequences after a risk event
Show the answer

Answer: D. One that reduces exposure by offsetting the impact of consequences after a risk event

IR 8286 defines a corrective control as reducing exposure by offsetting the impact of consequences after a risk event, distinguishing it from preventative, deterrent and detective controls.

Source: NIST IR 8286 (NIST) — Sec. 3.5.1 Applying Security Controls

Challenge yourself on this topic → Study as cards