ISC, Information Systems and Controls
Sources for Information Systems and Controls Core
Last reviewed
The standards and authorities behind PocketCPA's ISC lessons on Information Systems and Controls Core.
About this topic
ISC is the technology section of the exam. It is a discipline section covering IT governance, security, and SOC engagements.
Nothing in this section is arithmetic the way FAR is arithmetic. The few computations that appear are small, and they exist to make a concept concrete: an availability allowance in minutes, a symmetric key count, a batch total that does not reconcile, a deviation rate. The reasoning around the number is always what is being tested.
Key points
- ISC questions test classification (framework vs. law, ITGC vs. application control, SOC 1 vs. SOC 2) more than technical depth.
- Accountability matters: distinguish whether management, the service auditor, or the user entity is responsible.
- Controls are matched to risks by what they actually prevent or detect, not by their general category.
- The five trust services criteria are security, availability, processing integrity, confidentiality, and privacy.
What the lessons cover
- COSO Internal Control framework
- IT general controls
- SOC engagements
- Information systems and the transaction cycles
- The systems development life cycle and change management
- Application controls: input, processing, and output
- Cloud, virtualization, and networks
- Availability, backup, and business resilience
- Emerging technology: RPA and blockchain
- Frameworks, standards, and regulations
- Security: the CIA triad, defense in depth, and zero trust
- Identity and access management
- Cryptography
- Network defense and vulnerability management
- Threats and attacks
- The SOC engagement: parties, responsibilities, and criteria
- Subservice organizations, CSOCs, and CUECs
- Testing controls and evaluating deviations
- The SOC report: structure, opinion types, and use restrictions
- Bridge letters and the user auditor under AU-C 402
- NIST publications: the public-domain layer
Authoritative references
Internal control and governance:
- COSO Internal Control - Integrated Framework, the five components, and COSO Enterprise Risk Management.
- COBIT 2019, the IT governance framework; ISO/IEC 27001 and 27002, the information security management standards; ITIL, the service management framework.
- Sarbanes-Oxley Act Sections 302 and 404, management certification and the assessment of internal control over financial reporting.
Assurance:
- AT-C 320 and SSAE No. 18, SOC 1 reports; AT-C 205 and SSAE No. 21, SOC 2 and SOC 3 examinations; the AICPA description criteria in DC section 200; and the Trust Services Criteria.
- AU-C 402, the user auditor's use of a service organization's report, and bridge letters.
NIST publications:
- NIST SP 800-53 Rev. 5, the control catalog, including AC-2, AC-5 and AC-6, AU-2 and AU-6, CA-8, CM-3, CP-2, CP-4, CP-9 and CP-10, IA-2, IR-4 and IR-8, RA-5, SA-3 and SA-11, SC-7, SC-8, SC-12, SC-13 and SC-17, and SI-2, SI-3, SI-4 and SI-10.
- NIST SP 800-34 Rev. 1, contingency planning; SP 800-61, incident response; SP 800-63-4, digital identity; SP 800-171, protection of controlled unclassified information; FIPS 180-4, the hash standard.
Laws and industry standards:
- HIPAA, GDPR, and PCI DSS, and the requirements they impose on controls over protected health information, personal data, and payment card data.
How PocketCPA uses these sources
Every lesson is written in original words and cites the paragraph each rule comes from. No standard's text is reproduced. How lessons and questions are written and checked is set out in our methodology.