EXAM-007 - Preventive vs Detective vs Corrective Controls

Topic Summary

Control type matters because risk treatment should match the desired risk effect.

Key Concepts

• Preventive: stop or reduce likelihood before occurrence.
• Detective: identify events or deviations.
• Corrective: fix, recover, or reduce impact after occurrence.
• A balanced control set usually needs more than one type.

Common Exam Traps

• Treating detective controls as prevention.
• Adding controls without checking risk treatment objective.
• Assuming more controls always means better treatment.

Related Notes

• Control Attributes and Risk Treatment Effects
• ISO27002 Control Attributes
• Risk Assessment