Lumenary Prep

Uniform CPA Examination, Information Systems and Controls (Discipline section)

CPA Exam: Information Systems and Controls (ISC)

Information systems, data management, security, privacy and SOC engagements.

AI-drafted · awaiting expert reviewWritten to the Uniform CPA Examination Blueprints effective January 1, 2027 (approved by the AICPA Board of Examiners on September 16, 2026), Information Systems and Controls section, for ISC testing from January 2027. The ISC content of the blueprints effective January 1, 2026 (in force through December 31, 2026) is the same except for blockchain, which the 2027 edition narrows; the course notes the difference. Exam facts, testing windows and target score release dates were verified on aicpa-cima.com and nasba.org on 9 November 2026; regulations are cited from the eCFR as current on 5 November 2026.

A complete, original course for the Information Systems and Controls (ISC) Discipline section of the Uniform CPA Examination. Twenty lessons follow the AICPA's ISC blueprint area by area: information systems and data management (IT infrastructure and cloud, ERP and business processes, processing integrity, availability and recovery, change management, data storage, databases, SQL and process models); security, confidentiality and privacy (the NIST Cybersecurity Framework, Privacy Framework and SP 800-53, the other frameworks the blueprint lists, HIPAA and the GDPR, threats and attacks, preventive, detective and corrective controls, identity and access, encryption and data protection, testing and incident response); and SOC engagements (SOC 1, SOC 2, SOC 3 and SOC for Cybersecurity, the Trust Services Criteria, planning, subservice organizations, CUECs, system descriptions, testing and reporting). Each lesson teaches the rules with worked examples, common traps and a self-check, followed by practice questions and task-based-simulation-style cases with full explanations. A full-length practice exam mirrors the section's two multiple-choice testlets and three simulation testlets. Use it alongside the AICPA's blueprint and sample test.

About the exam

Syllabus

20 lessons, 212 practice questions and 1 timed practice exam.

Getting Started

  1. How the ISC section works

    The CPA Exam's Core-plus-Discipline model, the ISC section's 82 multiple-choice questions and 6 task-based simulations in five testlets, its 60/40 score weighting, the 0–99 scale and passing score of 75, the quarterly Discipline testing windows and score release, the 2027 platform change, and a study plan built on the blueprint's weights.

    1. The ISC section and the whole CPA ExamFree sample30 min

Area I: Information Systems and Data Management (35–45%)

  1. IT infrastructure and enterprise systems

    The components of IT architecture and cloud computing models, the role of cloud service providers and COSO's guidance on cloud governance; ERP and accounting information systems, the business processes they support and ways to improve them; and controls over processing integrity, including SOC 2 testing against the Trust Services Criteria.

    1. IT infrastructure and cloud computing(included with the course)45 min
    2. Enterprise systems and business processes(included with the course)45 min
    3. Processing integrity controls(included with the course)45 min

  2. Availability and change management

    Business resilience, continuity and disaster recovery, business impact analysis, availability measures, mirroring, replication and backups; and the change management process: tools, environments, testing, conversion methods, patch and configuration management, and how an auditor tests change controls.

    1. Availability, continuity and recovery(included with the course)50 min
    2. Change, configuration and patch management(included with the course)50 min

  3. Data management

    Data extraction, data warehouses, lakes and marts, star and snowflake schemas and the data life cycle; relational database integrity, data dictionaries and normalization; reading SQL queries for relevance and completeness; integrating data sources; and reading business process models.

    1. Data extraction, storage and the data life cycle(included with the course)45 min
    2. Relational databases, SQL and process models(included with the course)55 min

Area II: Security, Confidentiality and Privacy (35–45%)

  1. Regulations, standards and frameworks

    The NIST Cybersecurity Framework, the NIST Privacy Framework and NIST SP 800-53; the other frameworks the blueprint lists (CIS Controls, COBIT 2019, PCI DSS) and COSO's guidance on cyber risk; and the HIPAA Privacy and Security Rules and the GDPR.

    1. NIST frameworks — CSF 2.0, the Privacy Framework and SP 800-53(included with the course)50 min
    2. CIS Controls, PCI DSS, COBIT 2019 and COSO on cyber risk(included with the course)60 min
    3. Privacy and security regulations — HIPAA and the GDPR(included with the course)55 min

  2. Security: threats, mitigation and access

    Threat agents, attack types and techniques, the stages of a cyber-attack and the risks of cloud, IoT and mobile technology; preventive, detective and corrective controls, defense in depth, least privilege and zero trust; and identification, authentication and authorization.

    1. Threats, attacks and the stages of a cyber-attack(included with the course)50 min
    2. Mitigating cyber risk — preventive, detective and corrective controls(included with the course)50 min
    3. Identification, authentication and authorization(included with the course)50 min

  3. Confidentiality, privacy, testing and incident response

    Encryption, obfuscation, tokenization and data loss prevention; the difference between confidentiality and privacy; the costs of a data breach; testing security, confidentiality and privacy controls; and incident response plans, cyber insurance and testing the response to an incident.

    1. Confidentiality, privacy and encryption controls(included with the course)55 min
    2. Testing security controls and responding to incidents(included with the course)55 min

Area III: Considerations for SOC Engagements (15–25%)

  1. SOC engagements

    The SOC suite (SOC 1, SOC 2, SOC 3, SOC for Cybersecurity), the Trust Services Criteria and management's assertions; planning a SOC engagement (independence, materiality, risk assessment, system boundaries, written representations, subsequent events); subservice organizations, the carve-out and inclusive methods, CUECs, CSOCs and the system description; and testing controls and reporting, including modified opinions.

    1. The SOC suite and the Trust Services CriteriaFree sample45 min
    2. Planning a SOC engagement(included with the course)45 min
    3. Subservice organizations, CUECs and the system description(included with the course)50 min
    4. Testing controls and reporting in SOC engagements(included with the course)50 min

Practice exams

  • ISC Practice Exam 1 (full length)114 questions · 240 minutesIncluded with the course

Free official resources

Use these alongside the course. They are free, and they are the final word.

  • Uniform CPA Examination BlueprintsThe AICPA's official blueprints (effective January 1, 2026 and January 1, 2027) and the summary of 2027 changes. Read the ISC section introduction, references and representative tasks; this course follows them area by area.
  • CPA Exam sample testThe AICPA's sample test runs in the real exam software and includes ISC questions. It is shorter than a section and is not a readiness score. Take it before test day to learn the interface; it is linked here, not reproduced.
  • Find out when you'll get your CPA Exam scoreDiscipline testing windows and target score release dates, including the adjusted schedule after the July 2027 platform change.
  • CPA Exam user-interface changes coming in 2027What the AICPA has announced about the new delivery platform, the July 2027 testing pause and score recalibration.
  • NASBA CPA Exam FAQ and candidate guideScheduling, breaks, score release and the rules that vary by jurisdiction. NASBA's CPA Exam Candidate Guide covers the testing day in detail.
  • 2017 Trust Services Criteria and 2018 SOC 2 description criteriaThe criteria named in the ISC blueprint's references, free to download after creating a free AICPA account. The SOC 2 description criteria are linked from the same AICPA SOC pages.
  • AICPA attestation standards (AT-C sections)The currently effective AT-C sections, including section 320 (SOC 1) and sections 105 and 205, which SOC 2 engagements follow.
  • NIST Cybersecurity Framework 2.0The CSF 2.0 document, quick-start guides and informative references. NIST publications are free and public domain.
  • NIST Privacy FrameworkVersion 1.0, the version the ISC blueprint's references describe, with NIST's current drafts.
  • NIST SP 800-53 Rev. 5The control catalog; the ISC blueprint makes chapters 1 and 2 eligible.
  • HIPAA regulations, 45 CFR Part 164 (eCFR)The Security, Breach Notification and Privacy Rules; the blueprint makes §§ 164.103–164.530 eligible.
  • General Data Protection Regulation (EUR-Lex)Regulation (EU) 2016/679; the blueprint makes Articles 4–34 eligible.
  • COSO guidance on cloud computing and cyber riskCOSO's Managing Cyber Risk in a Digital Age; its Enterprise Risk Management for Cloud Computing is at coso.org/erm-cloud-computing. Both are listed in the ISC blueprint's references.
  • CIS Critical Security Controls v8.1The Center for Internet Security's Controls; the ISC blueprint makes the Overview and 'Why is this Control critical?' sections of Controls 1–18 eligible. The full v8.1 document is a download from this page; the Implementation Groups are explained at cisecurity.org/controls/implementation-groups.
  • PCI Data Security Standard (PCI DSS)The PCI Security Standards Council's PCI DSS page, with its document library, validation roles (QSA, ISA, ASV) and a link to order the PCI DSS v4.x Quick Reference Guide named in the ISC blueprint's references.
  • COBIT (ISACA)ISACA's COBIT resources. The blueprint lists chapters 1–5 of COBIT 2019 Framework: Introduction and Methodology, offered through ISACA's store, and ISACA's free white papers on Area I and II topics.

Lumenary Prep is not affiliated with or endorsed by the AICPA, NASBA or any state board of accountancy. Only a state board of accountancy grants the CPA license. The AICPA's blueprints and standards, and the FASB's, GASB's, PCAOB's and COSO's materials, are copyrighted: this course explains them in its own words and links to the official text. Every source this course cites.