The ISC section and the whole CPA Exam

The exam in one picture

To become licensed, a CPA candidate passes four exam sections: the three Core sections that everyone takes, plus one Discipline section of the candidate's choice (AICPA, Everything You Need to Know About the CPA Exam; NASBA, CPA Exam Candidate Guide). The sections may be taken in any order, and each one is four hours long, so the whole exam is 16 hours of testing (NASBA, CPA Exam Candidate Guide).

Group	Sections	Who takes it
Core	Auditing and Attestation (AUD), Financial Accounting and Reporting (FAR), Taxation and Regulation (REG)	Every candidate
Discipline	Business Analysis and Reporting (BAR), Information Systems and Controls (ISC), Tax Compliance and Planning (TCP)	Each candidate chooses one

ISC is the Discipline for candidates drawn to IT audit and advisory work. According to the blueprint, it tests information systems (including processing integrity, availability, security, confidentiality and privacy), data management across the data life cycle, and System and Organization Controls (SOC) engagements, with SOC 2 at its center and selected parts of SOC 1 (ISC blueprint, Section Introduction).

What the ISC section looks like

Every section is delivered in five parts called testlets: two testlets of multiple-choice questions (MCQs) followed by three testlets of task-based simulations (TBSs) (ISC blueprint, Introduction). ISC has the most MCQs and the fewest TBSs of any section.

Testlet	Content	Items
1	Multiple-choice questions	41
2	Multiple-choice questions	41
3	Task-based simulation	1
4	Task-based simulations	3
5	Task-based simulations	2
Total	4 hours	82 MCQs, 6 TBSs

Two facts follow from this layout:

• ISC is weighted 60% MCQs and 40% TBSs. Every other section is 50/50 (ISC blueprint, Introduction; AICPA, Learn more about CPA Exam scoring; NASBA, Score Information). Speed and accuracy on 82 MCQs matter more here than anywhere else.
• One four-hour clock runs across all five testlets. A worked pacing plan helps. Here is one reasonable split. It is our suggestion, not an AICPA rule:

Part	Suggested time	Per item
Testlets 1 and 2 (82 MCQs)	2 hours 10 minutes	about 1.6 minutes
Testlets 3–5 (6 TBSs)	1 hour 40 minutes	about 16–17 minutes
Reserve for review	10 minutes
Total	4 hours

The arithmetic: 130 minutes ÷ 82 MCQs ≈ 1.59 minutes each; 100 minutes ÷ 6 TBSs ≈ 16.7 minutes each; 130 + 100 + 10 = 240 minutes.

Task-based simulations and research

TBSs are condensed case studies. In ISC, the blueprint says the assessment includes applied research: reviewing and using excerpts of source materials such as standards, regulations and frameworks to identify issues, analyze facts and decide on responses (ISC blueprint, Section Introduction). Expect exhibits such as a system description, a control matrix, a query, a policy, a log or an excerpt from a SOC report. The exam's spreadsheet tool is similar to Excel but not identical (AICPA, Find answers to frequently asked questions about the CPA Exam).

Breaks and the testing appointment

• After the first TBS testlet (testlet 3, roughly midway) you are offered a standardized 15-minute break that does not count against your four hours. You may accept or decline it (NASBA, CPA Exam Candidate Guide; NASBA, CPA Exam FAQ; AICPA FAQ).
• You may also take a break at the end of any other testlet, but the clock keeps running during those breaks (NASBA, CPA Exam Candidate Guide).
• The appointment time is testing time plus 30 minutes for login, the closing survey and the standardized break; it is not extra testing time (NASBA, CPA Exam Candidate Guide).

How ISC is scored

• Scores are reported on a 0–99 scale, and you need 75 to pass a section (AICPA, Learn more about CPA Exam scoring; NASBA, Score Information).
• 75 is not 75% correct. Scores are not curved; the scaling considers whether each answer is right and how difficult each question is (AICPA scoring page; NASBA, Score Information).
• Every exam includes pretest questions that do not count toward your score, and you cannot tell which ones they are (AICPA FAQ). Treat every item as if it counts.

Trap: A candidate who "felt" she got about 70% of the MCQs right cannot convert that into a score. Difficulty, the 60/40 weighting and unscored pretest items all intervene.

If you do not pass, NASBA describes a Candidate Performance Report that compares your performance, by content area and question type, with candidates who just passed (NASBA, CPA Exam Candidate Guide). It is a study tool for the retake.

When you can test and when scores arrive

Core sections can be scheduled year-round, but Discipline sections, including ISC, can be scheduled only in the first month of each calendar quarter (NASBA, CPA Exam FAQ). The AICPA publishes target score release dates for each Discipline window (AICPA, Find out when you'll get your CPA Exam score, dated August 31, 2026):

Discipline testing window	Target score release
October 1–31, 2026	December 15, 2026
January 1–31, 2027	March 16, 2027
April 1–30, 2027	June 9, 2027
July 12 – August 12, 2027	September 28, 2027
October 1–31, 2027	December 17, 2027
January 1–31, 2028	March 17, 2028
April 1–30, 2028	June 16, 2028

These are targets that can change. Boards of accountancy release the scores, and some boards need at least a day beyond the published dates (NASBA, CPA Exam FAQ; NASBA, CPA Exam Candidate Guide).

The July 2027 platform change

Beginning in July 2027 the CPA Exam moves to a new delivery platform with a new user interface. No exams are given from July 1 through July 11, 2027, and testing resumes on July 12, 2027. Because items must be recalibrated with data from candidates who test on the new platform, score release follows an adjusted schedule for 12 months after launch. That is why the July 2027 Discipline window runs to August 12 (AICPA, CPA Exam user-interface changes coming in 2027; AICPA score release page; NASBA, CPA Exam FAQ). If you plan to test in or after July 2027, watch the AICPA's pages for updated sample tests and tutorials.

Rules that depend on your jurisdiction

Eligibility, fees, how long passed-section credit lasts, and the time allowed to finish licensure are set by each state board of accountancy and vary by jurisdiction (NASBA, CPA Exam FAQ). Check your board's rules through NASBA before you schedule.

What the blueprint says ISC covers

This course follows the Uniform CPA Examination Blueprints effective January 1, 2027. The ISC content in that edition matches the January 1, 2026 edition except that the 2027 version narrows blockchain: it drops COSO's Blockchain and Internal Control from the references and removes one blockchain task (AICPA, Summary of Changes to the Exam Blueprints effective January 1, 2027).

Area	Weight	What it covers	Course units
I. Information Systems and Data Management	35–45%	IT infrastructure and cloud, ERP and accounting systems, processing integrity, availability and recovery, change management, data storage, databases, SQL and process models	Units 2–4
II. Security, Confidentiality and Privacy	35–45%	NIST CSF, NIST Privacy Framework, SP 800-53, CIS Controls, COBIT, PCI DSS, HIPAA, GDPR; threats, mitigation, access control; encryption and privacy controls; testing and incident response	Units 5–7
III. Considerations for SOC Engagements	15–25%	SOC 1, SOC 2, SOC 3 and SOC for Cybersecurity; planning, subservice organizations, CUECs, system descriptions, testing and reporting	Unit 8

The blueprint also sets skill levels for ISC: Remembering and Understanding 55–65%, Application 20–30%, Analysis 10–20%, and no Evaluation (ISC blueprint, Introduction). Recall therefore carries real weight in ISC, so learn definitions precisely. But a third or more of the section asks you to apply or analyze: detect a design deficiency, spot an operating deviation, compare a walkthrough with a policy, or judge whether a query returns a complete population.

Two more blueprint rules shape what you study:

• References are limited. When a task names a framework, regulation or standard, only the specific parts listed in the blueprint's references are eligible. Examples: Articles 4–34 of the GDPR, 45 CFR 164.103 through 164.530 for HIPAA, chapters 1 and 2 of NIST SP 800-53 Rev. 5, chapters 1–5 of COBIT 2019, and the "Overview" and "Why is this Control critical?" sections of CIS Controls v8.1. Links inside those documents to other sources are not eligible (ISC blueprint, References).
• Representative tasks are examples, not a complete list. A topic with more tasks is not necessarily weighted more heavily (ISC blueprint, Summary Blueprint).

A study plan that follows the weights

1. Weeks 1–3: Area I. Work through units 2–4. Do each lesson's practice set the same day.
2. Weeks 4–6: Area II. Units 5–7. Make a one-page sheet of the frameworks and regulations, with their parts and the sections the blueprint names.
3. Week 7: Area III. Unit 8. SOC questions reward exact vocabulary: type 1 versus type 2, carve-out versus inclusive, CUECs versus CSOCs.
4. Week 8: Review and practice exam. Take the practice exam under timed conditions, then reread the lessons behind every miss. Take the AICPA's sample test to learn the real software.

Adjust the pace to your own schedule. What matters is steady practice and honest review of every mistake.

Check yourself

• How many MCQs and TBSs are on ISC, and how are they split across the five testlets?
• Why does a strong MCQ performance matter more on ISC than on the other sections?
• Which break stops the clock, and when is it offered?
• In which months can you sit for ISC, and what changes in July 2027?
• Which three content areas does the ISC blueprint define, and what are their weights?