A corrective action addresses the root cause of an incident rather than treating its symptoms. It removes identified vulnerabilities or weaknesses, reduces recurrence risk, and strengthens the organization’s security posture. section 9.5
Develop corrective actions through a structured incident-analysis sequence:
- Collect relevant incident information and analyze it for patterns and potential causes. section 9.5
- Use techniques such as the Five Whys to move from visible symptoms to the underlying cause. section 9.5
- Identify whether the primary cause involved a vulnerability, misconfiguration, or attacker exploit. section 9.5
- Implement measures that eliminate the weakness and reduce the likelihood of recurrence. section 9.5
Financial institution data breach
A breach investigation identified a phishing email as the initial entry point and the lack of multifactor authentication for remote access as a critical vulnerability. Corrective actions included enabling MFA for remote access, strengthening phishing detection, training employees to recognize phishing, and upgrading network monitoring. section 9.5.1
