ISC CPA Exam (2026): What Is on Information Systems and Controls
Kyle Ashcraft, CPA · 2019 CPA Exam Scores · 95 FAR · 98 BEC · 91 REG · 90 AUD
I should say this first: I have not sat ISC. I took the four-part exam in 2019, before Disciplines existed, so I cannot describe it from experience. I did sit AUD and scored a 90, and ISC builds directly on it, so I read the AICPA's 2026 blueprint for ISC closely. This page is what that reading shows.
ISC stands for Information Systems and Controls. It is one of three Discipline sections, and it is the one least like any other section on the exam. Less of it is accounting, and more of it is knowing how technology systems work and how they fail.
Quick answer: ISC is a four-hour section with 82 multiple-choice questions and 6 task-based simulations. It is the only section where multiple choice counts for more than half the score: 60%, with simulations at 40%. It has three content areas: Information Systems and Data Management (35 to 45%), Security, Confidentiality and Privacy (35 to 45%), and SOC engagements (15 to 25%). About 55 to 65% of it is recall, so vocabulary and frameworks matter more here than anywhere else. Take it right after AUD if you can.
On this page
Last updated October 2026. Format, area weights, skill levels and topic lists are from the AICPA Uniform CPA Examination Blueprints effective January 2026. Scheduling rules are from the NASBA CPA Exam FAQ as read on October 12, 2026, and can vary by state board. Task counts below are counts of the representative tasks the blueprint lists, which the AICPA says are not an all-inclusive list.
How is the ISC section built?
| ISC at a glance | |
|---|---|
| Time | 4 hours |
| Multiple-choice questions | 82, in two testlets of 41 |
| Task-based simulations | 6, in three testlets of 1, 3 and 2 |
| Score weight | 60% multiple choice, 40% simulations |
| Remembering and understanding | 55 to 65% |
| Application | 20 to 30% |
| Analysis | 10 to 20% |
You need a 75 on the 0 to 99 scale, and your score is not the percentage of questions you got right. Compare this with the other Disciplines. BAR and TCP split their score evenly between multiple choice and simulations. ISC puts 60% on multiple choice and has the fewest simulations of any section on the exam. That changes how you should practice: this is the Discipline where a large bank of multiple-choice questions pays off the most.
What does ISC cover?
| Content area | Weight |
|---|---|
| I. Information Systems and Data Management | 35 to 45% |
| II. Security, Confidentiality and Privacy | 35 to 45% |
| III. Considerations for SOC Engagements | 15 to 25% |
Area I: Information Systems and Data Management
Two groups. The first, information systems, covers IT infrastructure (operating systems, servers, networks, cloud models such as IaaS, PaaS and SaaS), enterprise and accounting information systems, availability (disaster recovery, business continuity, backups, mirroring and replication), and change management (development, staging and production environments, the types of testing, conversion approaches such as direct, parallel and pilot, and patch management). The second is data management: data storage types such as data warehouses and data lakes, database structure and integrity, reading a standard SQL query, the data life cycle, and reading a business process model such as a flowchart or data flow diagram.
Area II: Security, Confidentiality and Privacy
Four groups. Regulations, standards and frameworks: HIPAA, GDPR, PCI DSS, the NIST Cybersecurity Framework and Privacy Framework, NIST SP 800-53, the CIS Controls and COBIT 2019. Security: threats and attacks, mitigation (layered security, least privilege, zero trust, authentication and authorization models) and testing. Confidentiality and privacy: encryption, data loss prevention and what a data breach costs. Incident response: the difference between an event and an incident, and what an incident response plan contains.
Area III: SOC Engagements
This is the audit-profession part. It covers planning and performing a SOC engagement (SOC 1, SOC 2, SOC 3 and SOC for Cybersecurity, the Trust Services Criteria, subservice organizations and the carve-out versus inclusive methods, complementary user entity controls, the system description) and reporting on one, including opinions and report modifications when deficiencies are found.
How is ISC different from AUD?
The AICPA advises taking a Discipline right after its related Core section, and for ISC that is AUD. The overlap is real but small. The AUD blueprint touches IT general controls, COSO, walkthroughs, the difference between SOC 1 and SOC 2 engagements, and the implications of an entity using a service organization. ISC takes the SOC part much further, since Area III is a whole area on it.
The rest is new. Going by the blueprints, cybersecurity and the Trust Services Criteria do not appear in the AUD blueprint, and the named regulations and frameworks in Area II (HIPAA, GDPR, PCI DSS, NIST, CIS, COBIT) appear in none of the other five blueprints. So a strong AUD helps with the control-testing mindset, but most of the vocabulary is learned fresh.
Where is ISC hard?
Count the representative tasks the blueprint lists for ISC. There are 96: 65 at remembering and understanding, 21 at application, and 10 at analysis.
| Content area | Recall | Application | Analysis |
|---|---|---|---|
| I. Information Systems and Data Management | 18 | 6 | 6 |
| II. Security, Confidentiality and Privacy | 30 | 9 | 4 |
| III. SOC Engagements | 17 | 6 | 0 |
Two things stand out. First, nearly half of the recall tasks, 30 of 65, sit in Area II. That is the long list of attacks, techniques, controls, frameworks and regulations that you either know or do not. You cannot reason your way to the meaning of a term you never learned, so this is a memorization job, and the work is to make it stick.
Second, look at what the 10 analysis tasks actually say. Most are audit work applied to technology. Perform a walkthrough of an organization's change management procedures and compare what you observe with the written policy. Detect deficiencies in the design or operation of controls in a SOC 2 engagement. Reconcile the actual steps of a business process with the documents and systems used. If you want to see what a walkthrough really involves, my audit walkthrough example follows one purchase from requisition to check.
My read of the blueprint: ISC rewards breadth. The topics are wide and mostly shallow: you need to recognize a lot of terms and say what each is for. The depth shows up in a small number of analysis tasks, which are the control-testing skills you already learned in AUD.
How would I study for ISC?
I have not sat it, so this is how I would plan from the blueprint, not a tested method.
- Build the vocabulary first. With 55 to 65% of the section at the recall level, start by learning each framework, regulation and attack type well enough to say its purpose in one sentence.
- Use multiple-choice practice heavily. Multiple choice is 60% of the score, so practice volume pays off more here than in any other section.
- Treat Area III as its own mini-course. SOC 1, SOC 2, SOC 3, the Trust Services Criteria, carve-out versus inclusive, CUECs and report opinions are all recall and application, and they all connect.
- Learn the tricky pairs. A security event versus an incident, confidentiality versus privacy, and preventive versus detective versus corrective controls are the kinds of distinctions multiple choice likes to test.
- Still practice simulations. They are 40% of the score, and the analysis tasks live there.
- Schedule it for the first month of a quarter. NASBA's FAQ says Discipline sections can only be scheduled in the first month of each quarter, so a missed window can cost you three months. Check your state board.
Is ISC the right Discipline for you?
ISC tends to suit candidates who work in IT audit, cybersecurity or technology consulting, who were strong in AUD, or who learn vocabulary and concepts well. If you work in tax or financial reporting, TCP or BAR may fit better. My comparison of BAR, ISC and TCP lays the three side by side, and the 30-month credit window page covers how long you have to finish. For the order of sections, see the best order to take the CPA exams. The same kind of guide exists for BAR and TCP.
I would not choose by published pass rates. They describe who sat the exam, not how hard it is for you.
What does Maxwell CPA Review include for ISC?
ISC is part of the same course as the Core sections. Since I have not sat ISC myself, I built it from the blueprint, so read the specs with that in mind.
| Discipline | Video | MCQs | TBS |
|---|---|---|---|
| ISC | 4.5 hrs | 602 | 8 |
Sources: AICPA Uniform CPA Examination Blueprints, effective January 2026 (format, weights, skill levels, topic lists and representative tasks for ISC and AUD); AICPA, "Seven things to know about the new CPA Exam" (Discipline choice and order); NASBA CPA Exam FAQ (Discipline scheduling). Read October 12 to 14, 2026. Task counts are my own count of the blueprint's representative tasks.
Frequently asked questions
What is the ISC section of the CPA exam?
ISC is Information Systems and Controls, one of three Discipline sections. It is four hours with 82 multiple-choice questions and 6 task-based simulations, weighted 60% and 40%. It covers information systems and data management, security, confidentiality and privacy, and SOC engagements.
What is on the ISC exam?
Information Systems and Data Management (35 to 45%), Security, Confidentiality and Privacy (35 to 45%) and SOC engagements (15 to 25%). Topics include cloud models, change management, SQL and databases, HIPAA, GDPR, PCI DSS, the NIST frameworks, encryption, incident response, and SOC 1, SOC 2 and SOC 3 reports.
Is ISC harder than AUD?
I cannot say from experience, since I have not sat ISC. ISC is recall-heavy (55 to 65%) and introduces cybersecurity and data topics that AUD's blueprint does not list. AUD is more judgment-based. Which is harder depends on your background.
When should I take ISC?
The AICPA recommends taking a Discipline right after its related Core section, which for ISC is AUD. NASBA's FAQ says Discipline sections can only be scheduled in the first month of each quarter, so plan around that and check with your state board.
What score do I need to pass ISC?
A 75 on the 0 to 99 scale, as with every section. Your score is not the percentage of questions answered correctly.
Start with the free CPA 101 course
Practice all 25 of the 2026 AICPA released MCQs, plus a free study outline, and see whether the explanations work for you. FAR, AUD and REG tracks available. No credit card required.
Kyle Ashcraft, CPA scored 90 or above on every section of the CPA exam in 2019. He is the founder and sole instructor of Maxwell CPA Review, where he creates every lecture, textbook and study outline himself.
Reach him at MaxwellCPAreview@gmail.com.
Double-click to edit...