ISC, Information Systems and Controls
Sources for Security: Access Control, Network Defense, Cryptography, and Threats
Last reviewed
The standards and authorities behind PocketCPA's ISC lessons on Security: Access Control, Network Defense, Cryptography, and Threats. The topic rests on NIST SP 800-53 Rev. 5 access, boundary, cryptographic and monitoring controls (the AC, IA, SC, SI, RA, CA, PE and AU families); NIST SP 800-63-4; FIPS 180-4 and FIPS 186-5; the CIA triad, IAM and access-control models, network defense, cryptography, and threats.
About this topic
Security is about keeping the wrong people out of a system and holding the right people to what their job needs. ISC.II.B is the technical core of that area: proving identity, deciding what an identity may do, defending the network, protecting data with cryptography, and recognizing the threats these controls counter.
So learn each concept together with the one feature that separates it from its nearest neighbor. Do that and the distractors stop working.
Key points
- Authentication verifies identity (something you know, have, or are); authorization controls what an authenticated user can access.
- Encryption protects data in transit and at rest; symmetric encryption is faster, asymmetric enables key exchange and digital signatures.
- Firewalls, IDS/IPS, and network segmentation are layered defenses that reduce the attack surface.
- Common threats include phishing, ransomware, SQL injection, and cross-site scripting.
What the lessons cover
- The CIA triad and defense in depth
- Authentication
- Authorization and access control models
- Network security architecture
- Cryptography
- Endpoint, application, and physical security
- Vulnerability management and testing
- Threats and attacks
- Security inside the IT general controls framework
- NIST control identifiers used in this lesson
- The discriminations these questions are built on
Authoritative references
- NIST SP 800-53 Rev. 5, the control catalog used for every identifier in the lesson, drawn from the Access Control (AC), Awareness and Training (AT), Audit and Accountability (AU), Assessment, Authorization and Monitoring (CA), Identification and Authentication (IA), Physical and Environmental Protection (PE), Personnel Security (PS), Risk Assessment (RA), System and Communications Protection (SC), and System and Information Integrity (SI) families. The identifiers and the topic each anchors are tabulated in the lesson section "NIST control identifiers used in this lesson."
- NIST SP 800-63-4, Digital Identity Guidelines (July 2025), which supersedes SP 800-63-3.
- FIPS 180-4, Secure Hash Standard (August 2015), whose digests detect whether a message has changed.
- FIPS 186-5, Digital Signature Standard (February 2023), which supersedes FIPS 186-4.
- Concepts with no control identifier, such as single sign-on, network access control, next-generation firewalls, credential vaulting, and endpoint detection and response, are stated as practice and not attributed to a control.
How PocketCPA uses these sources
Every lesson is written in original words and cites the paragraph each rule comes from. No standard's text is reproduced. How lessons and questions are written and checked is set out in our methodology.