The security controls that are most appropriate while dealing with the consequences of a security incident are corrective and recovery controls. Corrective controls are the controls that are implemented to restore the normal operations and functions of the system or network after a security incident, and to prevent or reduce the recurrence or impact of similar incidents in the future. Corrective controls can include actions such as isolating the affected components, removing the malicious code, repairing the damage, updating the patches, or modifying the policies. Recovery controls are the controls that are implemented to recover the data or information that was lost, corrupted, or compromised during a security incident, and to resume the availability and accessibility of the data or information for the authorized users. Recovery controls can include actions such as restoring the data from backups, decrypting the data, or recovering the keys12. References: CISSP CBK, Fifth Edition, Chapter 6, page 556; CISSP Practice Exam - FREE 20 Questions and Answers, Question
13.