Which category of information security controls addresses deficiencies in the control structure of an enterprise?

Which category of information security controls addresses deficiencies in the control structure of an enterprise?

• A. Corrective
• B. Preventive
• C. Compensating
• D. Directive

Answer: (C)

The category of information security controls that addresses deficiencies in the control structure of an enterprise is compensating controls. Compensating controls are implemented to mitigate risks when primary controls are inadequate or cannot be implemented for some reason. They serve to provide an alternative means of mitigating the same risk that the inadequate control was supposed to manage. Compensating controls are particularly critical in situations where a traditional control may be too costly, complex, or impractical to deploy. By providing alternative measures that can reduce the risk to an acceptable level, compensating controls ensure that the enterprise remains protected in the face of deficiencies within its existing control framework. In contrast, corrective controls are designed to fix or restore systems after an incident has occurred; preventive controls aim to deter or prevent incidents from occurring at all; and directive controls establish policies or procedures that guide behavior. Each of these other categories serves distinct purposes, but they do not directly address the deficiencies in the control structure itself as compensating controls do.

The category of information security controls that addresses deficiencies in the control structure of an enterprise is compensating controls. Compensating controls are implemented to mitigate risks when primary controls are inadequate or cannot be implemented for some reason. They serve to provide an alternative means of mitigating the same risk that the inadequate control was supposed to manage.

Compensating controls are particularly critical in situations where a traditional control may be too costly, complex, or impractical to deploy. By providing alternative measures that can reduce the risk to an acceptable level, compensating controls ensure that the enterprise remains protected in the face of deficiencies within its existing control framework.

In contrast, corrective controls are designed to fix or restore systems after an incident has occurred; preventive controls aim to deter or prevent incidents from occurring at all; and directive controls establish policies or procedures that guide behavior. Each of these other categories serves distinct purposes, but they do not directly address the deficiencies in the control structure itself as compensating controls do.