Home / CPA Course

CPA ISC notes · Information Systems and Controls

IT systems, data, security, privacy and SOC engagements. The most recall based section. The exam is 4 hours with 82 multiple choice questions and 6 task-based simulations.

Blueprint areas

Chapters

  1. IT infrastructure and cloud computing. Operating systems, servers, networks and end-user devices; IaaS, PaaS and SaaS; public, private and hybrid clouds; provider responsibilities; COSO and cloud governance
  2. Enterprise and accounting information systems. ERP and AIS; blockchain and internal control; process improvement such as robotic process automation; matching the real process to the documented one; processing integrity controls
  3. Availability. Business resiliency, continuity and disaster recovery; mirroring and replication; business impact analysis; availability measures; full, incremental and differential backups
  4. Change management. Change risks; tools and documentation; development, staging and production; test types; conversion methods; patch management; change control testing
  5. Data storage and the data life cycle. Extraction methods; data warehouse, lake and mart; star and snowflake schemas; the data life cycle
  6. Relational databases and SQL. Integrity rules, data dictionary and normalization; reading SQL queries for relevance and completeness
  7. Data integration and business process models. Combining data sources for analysis; flowcharts, data flow diagrams and BPMN
  8. Privacy and payment rules: HIPAA, GDPR and PCI DSS. HIPAA covered entities and permitted uses; GDPR scope, six principles and key concepts; PCI DSS requirements
  9. NIST frameworks. NIST Cybersecurity Framework; NIST Privacy Framework; purpose and audience of SP 800-53
  10. CIS Controls and COBIT 2019. Overview of the 18 CIS Controls; COBIT governance principles and components
  11. Threats and attacks. Threat agents; attack types and techniques; stages of an attack; cloud, IoT and mobile risks; threat modeling
  12. Protecting networks and systems. Segmentation, VPN, wireless and endpoint security; vulnerability management; defense in depth; least privilege and zero trust; acceptable use and BYOD; COSO and cyber risk
  13. Controls, authentication and authorization. Preventive, detective and corrective controls; passwords, MFA, single sign-on and biometrics; discretionary, role-based and mandatory access
  14. Testing security controls. Security awareness programs; security assessment reports; walkthroughs; control deficiencies under the Trust Services Criteria
  15. Confidentiality and privacy. Encryption; confidentiality versus privacy; obfuscation and tokenization; data loss prevention; cost of a breach; secure handling across the data life cycle
  16. Incident response. Events versus incidents; cyber insurance; the incident response plan; testing the response
  17. SOC engagements: types, users and criteria. SOC 1, SOC 2, SOC 3 and SOC for Cybersecurity; Type 1 and Type 2; the Trust Services Criteria; management assertions
  18. Planning and performing a SOC engagement. Independence; materiality; risk assessment; subservice organizations; inclusive and carve-out methods; system description; CUECs; representations; subsequent events
  19. Reporting on a SOC engagement. Effect of CUECs and CSOCs; opinion types and modifications; describing test results and exceptions; report form and content