Information Systems
Cybersecurity Risks and Controls for the CPA ISC Exam
By SimplyCPA · 11 October 2026
Text size
On this page (6)
- Main threats: Phishing and social engineering, ransomware, business email compromise, malicious or careless insiders, unpatched vulnerabilities and third-party (supply chain) compromise.
- Layered controls: MFA, least privilege, patching, network segmentation, encryption, logging and monitoring, backups and security awareness training — no single control is enough.
- NIST CSF 2.0: Six functions — Govern, Identify, Protect, Detect, Respond, Recover.
- Control types: Preventive (stop), detective (find) and corrective (fix) — plus deterrent and compensating controls.
- SEC disclosure: Public companies must disclose a material cybersecurity incident on Form 8-K within four business days of determining it's material, and describe risk management and governance annually.
Common threats
| Threat | How it works | Key controls |
|---|---|---|
| Phishing and social engineering | Tricks users into revealing credentials or running malware | Awareness training, email filtering, MFA |
| Ransomware | Encrypts data and demands payment | Offline/immutable backups, patching, endpoint detection, least privilege |
| Business email compromise | Impersonates an executive or supplier to redirect payments | Call-back verification of bank detail changes, dual approval of payments, MFA |
| Insider threats | Employees misuse access, maliciously or carelessly | Least privilege, access reviews, monitoring, segregation of duties |
| Unpatched vulnerabilities | Attackers exploit known software flaws | Vulnerability scanning, patch management |
| Supply-chain compromise | Attack through a vendor's software or access | Vendor risk assessment, SOC 2 reports, limiting vendor access |
| Denial of service | Overwhelms systems to make them unavailable | Traffic filtering, redundancy, capacity planning |
Control categories
- Preventive — firewalls, MFA, encryption, access restrictions.
- Detective — intrusion detection, log monitoring, security information and event management (SIEM), reconciliations.
- Corrective — incident response, restoring from backup, patching after discovery.
- Deterrent — warning banners, visible monitoring.
- Compensating — alternative controls when the primary one isn't feasible.
Controls can also be classified as administrative (policies, training), technical (logical) or physical (locks, badges). "Defense in depth" layers them so one failure doesn't expose everything.
NIST Cybersecurity Framework 2.0
Released in February 2024, CSF 2.0 organises cybersecurity outcomes into six functions:
- Govern — strategy, roles, policy and oversight (new in 2.0).
- Identify — assets, risks and improvement.
- Protect — safeguards such as identity management, training, data security and platform security.
- Detect — finding and analysing possible attacks.
- Respond — acting on a detected incident.
- Recover — restoring assets and operations.
SEC cybersecurity disclosure rules
- Form 8-K, Item 1.05 — disclose a material cybersecurity incident within four business days of determining it is material.
- Regulation S-K, Item 106 — describe cybersecurity risk management, strategy and governance (including board oversight) in the annual report.
Incident response
A typical incident response life cycle: preparation → detection and analysis → containment, eradication and recovery → post-incident activity (lessons learned). See ISC incident response.
Exam tip: MFA combines factors from different categories — something you know (password), have (token or phone) and are (biometric). Two passwords are not MFA.
Continue with the CIA triad and ISC security fundamentals.