which of the following?

Isn’t this preventative? I mean, in a BIA you are suggesting mitigating risks to possible vulnerabilities. Then management decides which risks to accept, and finally the company implements the mitigating controls… before anything happens. That’s preventative.

There are some corrective controls as well, like what to do when a system goes down, but the initial control mitigates the system going down in the first place.