Skip to content
SimplyCPA
CPA Exam/ISC

ISC

Discipline

Information Systems and Controls

Information Systems and Controls (ISC) sits where auditing meets information technology (IT): Information Systems and Data Management (35–45%), Security, Confidentiality and Privacy (35–45%), and System and Organization Controls (SOC) engagements (15–25%). It fits candidates interested in IT audit, risk, and controls, and rewards process thinking over calculation.

12 topics153 MCQsMedium~80 hrs total study time Official Blueprint

Last updated 5 September 2026

Topics by blueprint area

Sign in to track your progress
#TopicStudyRevisePractice
Area I: Information Systems and Data Management· 35–45% of the exam
1Information Technology General Controls (ITGCs)

The four domains of information technology general controls (ITGCs) and how they support reliance on automated controls.

Study Information Technology General Controls (ITGCs)Revise Information Technology General Controls (ITGCs)13 MCQs on Information Technology General Controls (ITGCs)
2Information Systems Fundamentals

Enterprise resource planning (ERP) and other systems, processing methods, cloud service models, networks, and business continuity.

Study Information Systems FundamentalsRevise Information Systems Fundamentals13 MCQs on Information Systems Fundamentals
3Data Management & Governance

The data life cycle, data quality dimensions, and governance roles and frameworks.

Study Data Management & GovernanceRevise Data Management & Governance13 MCQs on Data Management & Governance
4Business Processes & Automation

Key transaction cycles, robotic process automation, and controls over automated processes.

Study Business Processes & AutomationRevise Business Processes & Automation12 MCQs on Business Processes & Automation
5Systems Development & Change Management

System development life cycle (SDLC) phases, conversion methods, agile and DevOps, and change management controls.

Study Systems Development & Change ManagementRevise Systems Development & Change Management12 MCQs on Systems Development & Change Management
6Emerging Technology Considerations

Artificial intelligence (AI), blockchain and crypto assets, and the Internet of Things (IoT) — the risks they create and the controls that follow.

Study Emerging Technology ConsiderationsRevise Emerging Technology Considerations12 MCQs on Emerging Technology Considerations
Area II: Security, Confidentiality and Privacy· 35–45% of the exam
7Information Security Fundamentals

Confidentiality, integrity, and availability (CIA), threats, access management, encryption, network defenses, and cybersecurity frameworks.

Study Information Security FundamentalsRevise Information Security Fundamentals15 MCQs on Information Security Fundamentals
8Privacy & Regulatory Frameworks

Privacy principles, major privacy and data protection laws, and techniques such as anonymization and tokenization.

Study Privacy & Regulatory FrameworksRevise Privacy & Regulatory Frameworks13 MCQs on Privacy & Regulatory Frameworks
9Incident Response & Monitoring

The incident response life cycle, logging and monitoring, and breach notification obligations.

Study Incident Response & MonitoringRevise Incident Response & Monitoring13 MCQs on Incident Response & Monitoring
Area III: SOC Engagements· 15–25% of the exam
10Third-Party & Vendor Risk

Evaluating service providers, contractual protections, and ongoing vendor monitoring.

Study Third-Party & Vendor RiskRevise Third-Party & Vendor Risk12 MCQs on Third-Party & Vendor Risk
11System and Organization Controls (SOC) Engagements

System and Organization Controls (SOC) 1, 2, and 3 reports, Type 1 versus Type 2, the Trust Services Criteria, and modified opinions.

Study System and Organization Controls (SOC) EngagementsRevise System and Organization Controls (SOC) Engagements13 MCQs on System and Organization Controls (SOC) Engagements
12Information Technology (IT) Audit & Advisory Services

Types of information technology (IT) engagements, auditing through and with the computer, validating system reports, and independence limits.

Study Information Technology (IT) Audit & Advisory ServicesRevise Information Technology (IT) Audit & Advisory Services12 MCQs on Information Technology (IT) Audit & Advisory Services

Area weights are the share of the ISC exam from the AICPA's Uniform CPA Examination Blueprints, 2026 (unchanged for 2027). Official Blueprint