Backup procedures for an organization's critical data are considered to be corrective controls, as they are designed to restore normal operations after a disruption or failure. Corrective controls aim to minimize the impact of an incident and prevent recurrence. Directive, detective and compensating controls are not related to backup procedures. Directive controls are intended to guide or instruct users to follow policies and procedures.
Detective controls are intended to identify and report incidents or violations. Compensating controls are intended to mitigate the risk of a missing or ineffective primary control. References: CISA Review Manual (Digital Version), Chapter 2, Section 2.11