CPA Exam: Information Systems and Controls (ISC)

Sources

Everything this course cites. Every source is on an official site: aicpa-cima.com, nasba.org, nist.gov, coso.org, ecfr.gov, hhs.gov, ftc.gov, eur-lex.europa.eu, pcaobus.org, cisecurity.org, pcisecuritystandards.org, isaca.org.

CPA Exam user-interface changes coming in 2027AICPA & CIMA · accessed 2026-11-09 · Dated August 19, 2026. New delivery platform and user interface from July 2027; no appointments July 1–11, 2027; testing resumes July 12, 2027; items recalibrated, so score release is adjusted for 12 months after launch.
Everything You Need to Know About the CPA ExamAICPA & CIMA · accessed 2026-11-09 · Three four-hour Core sections and one four-hour Discipline section of the candidate's choice; a minimum score of 75 on each section.
Find answers to frequently asked questions about the CPA ExamAICPA & CIMA · accessed 2026-11-09 · Pretest questions are in every exam and are not scored; difficulty is accounted for in scoring; optional breaks between testlets; the clock stops for a 15-minute break after testlet 3; the exam's spreadsheet application is similar but not identical to Excel.
Find out when you'll get your CPA Exam scoreAICPA & CIMA · accessed 2026-11-09 · Dated August 31, 2026. Discipline testing windows and target score release dates for 2026, 2027 and the first half of 2028; the July 2027 platform transition, the July 1–11, 2027 testing pause and the adjusted schedule. All dates are targets and subject to change.
Get mappings relevant to the SOC suite of servicesAICPA & CIMA · accessed 2026-11-09 · AICPA mappings of the 2017 Trust Services Criteria to the NIST CSF, NIST SP 800-53 and ISO 27001.
Illustrative SOC 2® Report with Illustrative System DescriptionAICPA & CIMA · accessed 2026-11-09 · An illustrative SOC 2 type 2 report: management's assertion, the description of the system, the service auditor's report, and tests of controls and results. Available to AICPA members.
Illustrative SOC 3® ReportAICPA & CIMA · accessed 2026-11-09 · An illustrative SOC 3 report: management's assertion, the description of the boundaries of the system and the principal service commitments and system requirements, and the service auditor's report.
Learn more about CPA Exam scoring and pass ratesAICPA & CIMA · accessed 2026-11-09 · Dated October 22, 2026. Scores reported on a 0–99 scale; 75 to pass; not a percentage correct; not curved; difficulty taken into account; ISC weighted 60% MCQs and 40% TBSs.
Practice for the CPA Exam with Sample TestsAICPA & CIMA · accessed 2026-11-09 · The sample test includes questions from all six sections, including ISC; it is shorter than a section, uses the exam software, allows up to two hours, shows correct answers, and does not determine readiness.
Reporting on an Examination of Controls at a Service Organization Relevant to User Entities' Internal Control Over Financial Reporting (SOC 1®) (2025)AICPA & CIMA · accessed 2026-11-09 · The AICPA's SOC 1 guide (a paid publication), listed in the ISC blueprint's references. Its catalog page describes guidance on qualified and disclaimed opinions and on the inclusive and carve-out methods.
SOC 1® — SOC for Service Organizations: ICFRAICPA & CIMA · accessed 2026-11-09 · SOC 1 examines controls at a service organization likely to be relevant to user entities' internal control over financial reporting; intended for user entities and user auditors.
SOC 2® Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or PrivacyAICPA & CIMA · accessed 2026-11-09 · The AICPA's SOC 2 guide (a paid publication), listed in the ISC blueprint's references.
SOC 3® — SOC for Service Organizations: Trust Services Criteria for General Use ReportAICPA & CIMA · accessed 2026-11-09 · SOC 3 reports address the same five categories as SOC 2 with less detail, so they are general use reports that can be freely distributed.
SOC for CybersecurityAICPA & CIMA · accessed 2026-11-09 · A reporting framework through which a CPA reports on an organization's enterprise-wide cybersecurity risk management program.
System and Organization Controls: SOC Suite of ServicesAICPA & CIMA · accessed 2026-11-09 · SOC is a suite of service offerings CPAs may provide on system-level controls of a service organization or entity-level controls of other organizations.
2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy (With Revised Points of Focus — 2022)AICPA & CIMA (Assurance Services Executive Committee) · accessed 2026-11-09 · The control criteria used in SOC 2 and SOC 3 examinations. Free download after creating a free AICPA account. Copyrighted: explained here in our own words.
2018 SOC 2® Description Criteria (With Revised Implementation Guidance — 2022)AICPA & CIMA (Assurance Services Executive Committee) · accessed 2026-11-09 · The benchmarks for preparing and evaluating the description of a service organization's system in a SOC 2 examination. Free download after creating a free AICPA account. Copyrighted: explained here in our own words.
AICPA Exposure Drafts: Proposed 2027 SOC 2® Trust Services Criteria and Description CriteriaAICPA & CIMA (Assurance Services Executive Committee) · accessed 2026-11-09 · Proposed revisions exposed for comment (listed October 26, 2026). Proposals only: the ISC blueprint's references remain the 2017 TSC and 2018 description criteria.
AICPA Professional Standards: Attestation Standards, currently effective AT-C sections (as of August 2026)AICPA & CIMA (Auditing Standards Board) · accessed 2026-11-09 · AT-C section 105 (concepts common to all attestation engagements), section 205 (assertion-based examination engagements) and section 320 (examinations of controls at a service organization relevant to user entities' internal control over financial reporting: SOC 1). Copyrighted: explained here in our own words, never quoted.
Summary of Changes to the Exam Blueprints effective January 1, 2027AICPA & CIMA (Board of Examiners) · accessed 2026-11-09 · Item 5 (ISC): removes COSO's Blockchain and Internal Control from the references, removes one representative task and revises another to narrow the blockchain content; not intended to significantly change the nature or scope of ISC content.
Uniform CPA Examination Blueprints, effective January 1, 2026: Information Systems and Controls (ISC)AICPA & CIMA (Board of Examiners) · accessed 2026-11-09 · The blueprint in force for testing through December 31, 2026. Its ISC content matches the 2027 edition except for the blockchain items described in the 2027 summary of changes.
Uniform CPA Examination Blueprints, effective January 1, 2027: Information Systems and Controls (ISC), pages ISC1–ISC16AICPA & CIMA (Board of Examiners) · accessed 2026-11-09 · Approved by the Board of Examiners on September 16, 2026. Introduction: section design table (ISC: 4 hours, 82 MCQs, 6 TBSs; testlets 41/41/1/3/2), score weighting (ISC 60% MCQ / 40% TBS), skill allocation. ISC section introduction, content allocation (Area I 35–45%, Area II 35–45%, Area III 15–25%), references, and the area/group/topic tables with representative tasks. Downloaded from this AICPA page.
CIS Critical Security Controls Implementation Groups (IG1, IG2, IG3)Center for Internet Security · accessed 2026-11-09 · IGs prioritize implementation based on risk profile and resources; 153 Safeguards in v8 and v8.1. The linked IG1, IG2 and IG3 pages: IG1 is essential cyber hygiene with 56 Safeguards; IG2 adds 74; IG3 adds 23 for all 153; and each page describes the typical enterprise.
CIS Critical Security Controls Version 8.1Center for Internet Security · accessed 2026-11-09 · Describes the Controls as a prioritized set of Safeguards; v8.1 updates alignment to standards (adding the Govern function from NIST CSF 2.0), revises asset classes and clarifies Safeguard descriptions. The full v8.1 document, with each control's 'Why is this Control critical?' section, is a download from this page. Copyrighted: explained in our own words.
The 18 CIS Critical Security ControlsCenter for Internet Security · accessed 2026-11-09 · The names and overviews of Controls 1 through 18 in v8.1. Copyrighted: short names only; overviews paraphrased.
Guidance on Internal Control (Internal Control — Integrated Framework, 2013)COSO · accessed 2026-11-09 · COSO's internal control framework: five components and seventeen principles. Copyrighted: explained here in our own words.
Enterprise Risk Management for Cloud Computing (2021)COSO (with Crowe LLP) · accessed 2026-11-09 · Applies COSO's 2017 ERM framework (Integrating with Strategy and Performance) to cloud computing governance. Listed in the ISC blueprint's references. Copyrighted: explained here in our own words.
Managing Cyber Risk in a Digital Age (2019)COSO (with Deloitte Risk & Financial Advisory) · accessed 2026-11-09 · Applies COSO's 2017 ERM framework to cyber risk, for boards, audit committees, executives and practitioners. Listed in the ISC blueprint's references. Copyrighted: explained here in our own words.
16 CFR Part 314, Standards for Safeguarding Customer Information (FTC Safeguards Rule)Electronic Code of Federal Regulations (eCFR) · accessed 2026-11-09 · U.S. government work; text current as of November 5, 2026. Elements of an information security program (314.4), including FTC notification of events involving at least 500 consumers within 30 days (314.4(j)). Not listed in the ISC blueprint's references.
45 CFR Part 160, General Administrative Requirements (§§ 160.102–160.103)Electronic Code of Federal Regulations (eCFR) · accessed 2026-11-09 · U.S. government work; text current as of November 5, 2026. Definitions of covered entity, business associate and protected health information.
45 CFR Part 164, Security and Privacy (§§ 164.103–164.530)Electronic Code of Federal Regulations (eCFR) · accessed 2026-11-09 · U.S. government work; text current as of November 5, 2026. Security Rule (164.302–164.318), Breach Notification Rule (164.400–164.414) and Privacy Rule (164.500–164.534), including 164.502 (uses and disclosures; minimum necessary) and 164.514 (de-identification).
Regulation (EU) 2016/679 (General Data Protection Regulation)European Union (EUR-Lex) · accessed 2026-11-09 · The ISC blueprint lists Articles 4 through 34. EU legislation; may be cited and briefly quoted with attribution.
Cybersecurity for Small Business: Cyber InsuranceFederal Trade Commission · accessed 2026-11-09 · U.S. government work, developed with the NAIC. What a policy should cover; typical first-party and third-party coverage.
Data Breach Response: A Guide for Business (August 2023)Federal Trade Commission · accessed 2026-11-09 · U.S. government work. Secure operations, fix vulnerabilities, notify appropriate parties; response team, forensics, service providers, segmentation, communications.
A New COBIT Is in Town and I Really Like How It Looks (ISACA Industry News, 10 December 2018)ISACA · accessed 2026-11-09 · The seven components of a governance system (replacing COBIT 5's enablers); 40 governance and management objectives in five domains: EDM (governance) and APO, BAI, DSS and MEA (management).
COBIT 2019 and COBIT 5 Comparison (ISACA Industry News, 27 April 2020)ISACA · accessed 2026-11-09 · Six governance system principles (five in COBIT 5); the three new governance framework principles (conceptual model, open and flexible, aligned to major standards); 40 processes; design factors; capability levels 0–5 based on CMMI.
COBIT 2019 and the IIA 2019 Guiding Principles of Corporate Governance (ISACA Industry News, 13 July 2020)ISACA · accessed 2026-11-09 · Lists and explains COBIT 2019's six governance system principles.
COBIT resources (COBIT 2019 Framework: Introduction and Methodology)ISACA · accessed 2026-11-09 · ISACA's COBIT page. The Introduction and Methodology volume, whose chapters 1–5 the ISC blueprint lists, is offered through ISACA's store; ISACA's published articles below summarize its principles, components and objectives.
Employing COBIT 2019 for Enterprise Governance Strategy (ISACA Industry News, 28 October 2019)ISACA · accessed 2026-11-09 · Describes the governance domain (Evaluate, Direct and Monitor) and the four management domains (APO, BAI, DSS, MEA).
Introducing COBIT 2019: The Motivation for the Update (ISACA Industry News, 29 October 2018)ISACA · accessed 2026-11-09 · Components of a governance system; focus areas (for example, small and medium enterprises, cybersecurity, digital transformation and cloud computing) and design factors used to tailor a governance system.
CPA Exam Candidate Guide (May 20, 2026)NASBA · accessed 2026-11-09 · Three Core sections and one Discipline section of your choice, in any order; 75 on each; four hours of testing (appointment adds 30 minutes for login, survey and the standardized break); break policy; score release process.
CPA Exam FAQNASBA · accessed 2026-11-09 · Discipline sections can be scheduled only in the first month of each quarter; the July 2027 platform transition; a standardized 15-minute break that does not count against testing time; optional breaks that do; eligibility, fees, credit and licensure rules vary by jurisdiction; boards of accountancy set the actual score release.
Score InformationNASBA · accessed 2026-11-09 · A score of 75 or higher passes; 75 does not mean 75% correct; ISC weighted 60% MCQs and 40% TBSs; scores are not curved; score review does not re-grade responses.
CSF 2.0 Informative ReferencesNational Institute of Standards and Technology · accessed 2026-11-09 · Lists informative references mapping other frameworks to CSF 2.0, including CIS Controls 8.1 and PCI DSS 4.0.1.
Cybersecurity Framework (CSF) home pageNational Institute of Standards and Technology · accessed 2026-11-09 · NIST's CSF resources: quick-start guides, informative references and implementation examples.
FIPS 180-4, Secure Hash Standard (SHS)National Institute of Standards and Technology · accessed 2026-11-09 · U.S. government work. Secure hash algorithms (SHA-2 family) producing message digests.
FIPS 186-5, Digital Signature Standard (DSS)National Institute of Standards and Technology · accessed 2026-11-09 · U.S. government work. Digital signatures for authentication of origin, integrity and non-repudiation.
FIPS 197, Advanced Encryption Standard (AES)National Institute of Standards and Technology · accessed 2026-11-09 · U.S. government work. AES, a symmetric block cipher with 128-, 192- and 256-bit keys.
NIST Computer Security Resource Center GlossaryNational Institute of Standards and Technology · accessed 2026-11-09 · U.S. government work. Definitions drawn from NIST publications, each with its source document.
NIST IR 8202, Blockchain Technology OverviewNational Institute of Standards and Technology · accessed 2026-11-09 · U.S. government work. Blockchains as distributed, tamper-evident and tamper-resistant digital ledgers; source of the NIST glossary definition.
NIST IR 8259, Foundational Cybersecurity Activities for IoT Device ManufacturersNational Institute of Standards and Technology · accessed 2026-11-09 · U.S. government work. IoT device cybersecurity capabilities and the risks of devices lacking them.
NIST Privacy FrameworkNational Institute of Standards and Technology · accessed 2026-11-09 · U.S. government work. The Privacy Framework's Core, Profiles and Implementation Tiers.
NIST Privacy Framework: A Tool for Improving Privacy through Enterprise Risk Management, Version 1.0 (January 16, 2020), NIST CSWP 01162020National Institute of Standards and Technology · accessed 2026-11-09 · U.S. government work. Three parts (Core, Profiles, Implementation Tiers); the five Functions Identify-P, Govern-P, Control-P, Communicate-P and Protect-P; the relationship between privacy and cybersecurity risk (cybersecurity-related privacy events; problematic data actions).
NIST SP 500-292, NIST Cloud Computing Reference ArchitectureNational Institute of Standards and Technology · accessed 2026-11-09 · U.S. government work. The five cloud actors: consumer, provider, auditor, broker and carrier.
NIST SP 800-115, Technical Guide to Information Security Testing and AssessmentNational Institute of Standards and Technology · accessed 2026-11-09 · U.S. government work. Review, target identification and analysis, and vulnerability validation techniques; reporting findings and recommendations.
NIST SP 800-122, Guide to Protecting the Confidentiality of Personally Identifiable Information (PII)National Institute of Standards and Technology · accessed 2026-11-09 · U.S. government work. PII confidentiality impact levels and safeguards such as minimizing use, de-identification and anonymization.
NIST SP 800-124 Rev. 2, Guidelines for Managing the Security of Mobile Devices in the EnterpriseNational Institute of Standards and Technology · accessed 2026-11-09 · U.S. government work. Mobile device threats and enterprise mobility management.
NIST SP 800-128, Guide for Security-Focused Configuration Management of Information SystemsNational Institute of Standards and Technology · accessed 2026-11-09 · U.S. government work. Baseline configurations, configuration change control, security impact analysis and configuration monitoring.
NIST SP 800-144, Guidelines on Security and Privacy in Public Cloud ComputingNational Institute of Standards and Technology · accessed 2026-11-09 · U.S. government work. The organization remains accountable for security and privacy of data and services it places in a public cloud; managing providers through contracts and oversight.
NIST SP 800-145, The NIST Definition of Cloud Computing (September 2011)National Institute of Standards and Technology · accessed 2026-11-09 · U.S. government work. The definition of cloud computing, its five essential characteristics, the IaaS, PaaS and SaaS service models, and the private, community, public and hybrid deployment models.
NIST SP 800-161 Rev. 1, Cybersecurity Supply Chain Risk Management Practices for Systems and OrganizationsNational Institute of Standards and Technology · accessed 2026-11-09 · U.S. government work. Risks from suppliers, vendors and other third parties throughout the supply chain.
NIST SP 800-162, Guide to Attribute Based Access Control (ABAC) Definition and ConsiderationsNational Institute of Standards and Technology · accessed 2026-11-09 · U.S. government work. Access control models, including discretionary, mandatory, role-based and attribute-based access control.
NIST SP 800-167, Guide to Application WhitelistingNational Institute of Standards and Technology · accessed 2026-11-09 · U.S. government work. Allowing only approved applications to run.
NIST SP 800-188, De-Identifying Government Datasets: Techniques and GovernanceNational Institute of Standards and Technology · accessed 2026-11-09 · U.S. government work. De-identification techniques and re-identification risk.
NIST SP 800-207, Zero Trust ArchitectureNational Institute of Standards and Technology · accessed 2026-11-09 · U.S. government work. Zero trust assumes no implicit trust based on network location; per-request, least-privilege access decisions.
NIST SP 800-218, Secure Software Development Framework (SSDF) Version 1.1National Institute of Standards and Technology · accessed 2026-11-09 · U.S. government work. Secure development practices, including protecting code from unauthorized changes, reviewing code and archiving releases.
NIST SP 800-30 Rev. 1, Guide for Conducting Risk AssessmentsNational Institute of Standards and Technology · accessed 2026-11-09 · U.S. government work. Threat sources (adversarial, accidental, structural, environmental), threat events, vulnerabilities, likelihood and impact.
NIST SP 800-34 Rev. 1, Contingency Planning Guide for Federal Information SystemsNational Institute of Standards and Technology · accessed 2026-11-09 · U.S. government work. The contingency planning process, the business impact analysis (determine business processes and recovery criticality including MTD, RTO and RPO; identify resource requirements; identify recovery priorities), types of plans, backups and alternate sites.
NIST SP 800-40 Rev. 4, Guide to Enterprise Patch Management Planning: Preventive Maintenance for Technology (April 2022)National Institute of Standards and Technology · accessed 2026-11-09 · U.S. government work. Patching as preventive maintenance; risk-based prioritization; maintenance plans; the patch deployment life cycle and its metrics.
NIST SP 800-41 Rev. 1, Guidelines on Firewalls and Firewall PolicyNational Institute of Standards and Technology · accessed 2026-11-09 · U.S. government work. Firewall technologies and policy, network segmentation.
NIST SP 800-46 Rev. 2, Guide to Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD) SecurityNational Institute of Standards and Technology · accessed 2026-11-09 · U.S. government work. Remote access methods (including VPNs), securing telework and BYOD client devices.
NIST SP 800-50 Rev. 1, Building a Cybersecurity and Privacy Learning ProgramNational Institute of Standards and Technology · accessed 2026-11-09 · U.S. government work. Cybersecurity and privacy awareness and training programs.
NIST SP 800-52 Rev. 2, Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) ImplementationsNational Institute of Standards and Technology · accessed 2026-11-09 · U.S. government work. TLS for protecting data in transit.
NIST SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and OrganizationsNational Institute of Standards and Technology · accessed 2026-11-09 · U.S. government work. Chapters 1 (purpose, applicability, target audience, organizational responsibilities) and 2 (fundamentals) are the parts the ISC blueprint lists.
NIST SP 800-53A Rev. 5, Assessing Security and Privacy Controls in Information Systems and OrganizationsNational Institute of Standards and Technology · accessed 2026-11-09 · U.S. government work. Assessment methods (examine, interview, test) and documenting assessment results.
NIST SP 800-57 Part 1 Rev. 5, Recommendation for Key Management: Part 1 — GeneralNational Institute of Standards and Technology · accessed 2026-11-09 · U.S. government work. Key types, key life cycle and protection of keys.
NIST SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile (April 2025)National Institute of Standards and Technology · accessed 2026-11-09 · U.S. government work. Supersedes Rev. 2. Organizes incident response around the CSF 2.0 Functions; definitions of events and incidents; roles and responsibilities.
NIST SP 800-63-4, Digital Identity Guidelines (July 2025), and SP 800-63B-4, Authentication and Authenticator ManagementNational Institute of Standards and Technology · accessed 2026-11-09 · U.S. government work. Final July 2025, superseding the -3 series. Authenticators, multi-factor authentication, password (memorized secret) requirements and verifier practices.
NIST SP 800-83 Rev. 1, Guide to Malware Incident Prevention and Handling for Desktops and LaptopsNational Institute of Standards and Technology · accessed 2026-11-09 · U.S. government work. Malware categories and prevention, detection and handling.
NIST SP 800-88 Rev. 2, Guidelines for Media Sanitization (September 2025)National Institute of Standards and Technology · accessed 2026-11-09 · U.S. government work. Supersedes Rev. 1 (December 2014, withdrawn). Sanitization program guidance and choosing sanitization methods by media type and data sensitivity.
NIST SP 800-94, Guide to Intrusion Detection and Prevention Systems (IDPS)National Institute of Standards and Technology · accessed 2026-11-09 · U.S. government work. Intrusion detection versus intrusion prevention; network-based and host-based systems.
The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29 (February 26, 2024)National Institute of Standards and Technology · accessed 2026-11-09 · U.S. government work. The CSF Core (Govern, Identify, Protect, Detect, Respond, Recover), Organizational Profiles and Tiers.
Auditing Interpretations of the PCAOB (fiscal years beginning on or after December 15, 2024): AI 18, Consideration of an Entity's Use of a Service OrganizationPCAOB · accessed 2026-11-09 · AI 18 describes the carve-out and inclusive methods for subservice organizations, how each affects the service auditor's report, and what a description of tests of operating effectiveness should contain (sample size, number and nature of exceptions).
Auditing Standards of the PCAOB (fiscal years beginning on or after December 15, 2024): AS 2601 and AS 2201, Appendix BPCAOB · accessed 2026-11-09 · AS 2601, Consideration of an Entity's Use of a Service Organization (user auditor and service auditor), and AS 2201 Appendix B on using service auditors' reports in an integrated audit of internal control over financial reporting.
Standards and Emerging Issues Advisory Group: Discussion — Service Organizations (briefing paper, November 2, 2023)PCAOB (Office of the Chief Auditor staff) · accessed 2026-11-09 · Staff background paper: the history of AS 2601 (from AU 324; the AICPA's later SSAE No. 16 and SSAE No. 18, AT-C 320), user and service auditor roles, and common uses of service organizations. Not a statement of the Board.
PCI Data Security Standard (PCI DSS)PCI Security Standards Council · accessed 2026-11-09 · PCI DSS provides a baseline of technical and operational requirements to protect payment account data; intended for entities that store, process or transmit cardholder data or sensitive authentication data or could affect the security of the cardholder data environment; roles of QSAs, ISAs and ASVs; whether an entity must validate is decided by payment brands, acquirers or others that manage compliance programs. The Quick Reference Guide is ordered from the Council.
PCI DSS Self-Assessment Questionnaire C and Attestation of Compliance, for use with PCI DSS Version 4.0 (April 2022)PCI Security Standards Council · accessed 2026-11-09 · Publicly readable. Lists the six goals and the titles of the 12 principal requirements in PCI DSS v4.0; defines account data (cardholder data and sensitive authentication data); SAQ eligibility, scoping, segmentation, the Attestation of Compliance, ASV scans, the Report on Compliance and the customized approach. Copyrighted: short names only.
PCI SSC Standards overviewPCI Security Standards Council · accessed 2026-11-09 · The Council's family of standards, including PCI DSS, point-to-point encryption (which may help reduce the scope of the cardholder data environment) and device and software standards.