Certified Public Accountant (CPA) Information Systems and Controls (ISC) — Discipline Syllabus

State the CIA triad and define each component.

Confidentiality — data accessible only to authorized parties. Integrity — data is accurate and unaltered. Availability — data and systems are accessible when needed. The CIA triad is the foundation of information security.

List the five core functions of the NIST Cybersecurity Framework.

Identify, Protect, Detect, Respond, and Recover. (NIST CSF 2.0 adds a sixth function, Govern.) They provide a lifecycle approach to managing cybersecurity risk.

Define defense in depth.

A layered security strategy applying multiple independent controls (physical, network, host, application, data) so that if one control fails, others still protect the asset.

Explain the principle of least privilege.

Users, processes, and systems should be granted only the minimum access rights needed to perform their function — no more — reducing the attack surface and limiting damage from compromise.

Distinguish authentication, authorization, and accounting (AAA) in access control.

Authentication: verifying identity (who you are). Authorization: granting permissions to resources (what you can do). Accounting: logging and monitoring actions (what you did).

What is multi-factor authentication (MFA) and what factor categories does it combine?

MFA requires two or more factors from different categories: something you know (password), something you have (token/phone), and something you are (biometric). It strengthens authentication beyond passwords alone.

Compare role-based access control (RBAC) and attribute-based access control (ABAC).

RBAC grants access based on a user's assigned role/job function. ABAC grants access based on evaluated attributes (user, resource, environment, action), offering finer-grained, dynamic control.

What is provisioning and deprovisioning in identity management, and why is timely deprovisioning critical?

Provisioning creates/grants user access when needed; deprovisioning revokes it when no longer needed. Timely deprovisioning (especially at termination) prevents orphaned accounts and unauthorized access.

Differentiate a threat, a vulnerability, and a risk.

Threat: a potential cause of harm (hacker, malware). Vulnerability: a weakness that a threat can exploit (unpatched software). Risk: the likelihood and impact of a threat exploiting a vulnerability.

Define an attack vector and give examples.

An attack vector is the path or method an attacker uses to gain unauthorized access. Examples: phishing emails, malware, compromised credentials, unpatched vulnerabilities, and removable media.

Distinguish phishing, spear phishing, and whaling.

Phishing: mass fraudulent messages to many targets. Spear phishing: tailored to a specific individual/organization. Whaling: spear phishing aimed at high-value executives (the 'big fish').

What is a SQL injection attack?

An attack where malicious SQL code is inserted into an input field to manipulate a backend database — allowing data theft, modification, or deletion. Mitigated by input validation and parameterized queries.

Differentiate a DoS attack from a DDoS attack.

DoS (Denial of Service): a single source floods a system to make it unavailable. DDoS (Distributed Denial of Service): many compromised systems (a botnet) flood the target simultaneously, harder to stop.

What is ransomware and what control most directly enables recovery from it?

Ransomware is malware that encrypts a victim's data and demands payment for the decryption key. Reliable, tested, offline/immutable backups are the most direct control enabling recovery without paying.

Define social engineering.

Manipulating people into divulging confidential information or performing actions that compromise security, exploiting human trust rather than technical weaknesses (e.g., pretexting, baiting, tailgating).

Name three major privacy regulations and the data/jurisdiction each protects.

GDPR — personal data of EU residents. CCPA/CPRA — personal information of California consumers. HIPAA — protected health information (PHI) in the US healthcare sector.

Distinguish PII from PHI.

PII (Personally Identifiable Information): data that identifies an individual (name, SSN, address). PHI (Protected Health Information): individually identifiable health information covered specifically by HIPAA.

What are the GDPR rights of a data subject (key examples)?

Right to access, right to rectification, right to erasure ('right to be forgotten'), right to restrict processing, right to data portability, and right to object. Consent must be freely given and revocable.

Define data minimization and purpose limitation as privacy principles.

Data minimization: collect only the personal data necessary for the stated purpose. Purpose limitation: use personal data only for the specific, declared purpose for which it was collected.

List the phases of incident response per the common NIST model.

1) Preparation, 2) Detection and analysis, 3) Containment, 4) Eradication, 5) Recovery, and 6) Post-incident activity (lessons learned). (Some frameworks combine eradication and recovery.)

Define RTO and RPO in business continuity planning.

RTO (Recovery Time Objective): maximum acceptable time to restore a system after disruption. RPO (Recovery Point Objective): maximum acceptable amount of data loss measured in time (how far back the last usable backup is).

Distinguish a Business Continuity Plan (BCP) from a Disaster Recovery Plan (DRP).

BCP: broad plan to keep critical business functions operating during/after a disruption. DRP: a subset focused specifically on restoring IT systems, data, and infrastructure after a disaster.

Compare hot, warm, and cold recovery sites.

Hot site: fully equipped, near-immediate failover (highest cost). Warm site: partially equipped, needs some setup/data load (moderate). Cold site: basic space/utilities only, longest recovery (lowest cost).

Define IT general controls (ITGCs) and name their main categories.

ITGCs are pervasive controls over the IT environment that support reliable operation of applications. Main categories: access to programs and data, program change management, program development, and computer operations.

Why do ITGCs matter for auditing application controls?

Application controls can only be relied upon if ITGCs are effective. Weak ITGCs (e.g., poor change management or access controls) undermine the integrity of automated controls and the data they process.

Differentiate application controls from IT general controls.

Application controls are specific to a single application/process (input, processing, output controls ensuring transaction accuracy). ITGCs are environment-wide controls supporting all applications. App controls rely on ITGCs to be effective.

Classify the three types of application controls by transaction stage.

Input controls (validation, edit checks at data entry), processing controls (ensuring accurate computation/updating), and output controls (ensuring complete, accurate, authorized distribution of results).

What is an automated control versus a manual control, and what is a key advantage of automated controls?

Automated controls are performed by the system without human intervention; manual controls require people. Automated controls are consistent and reliable — if designed properly and ITGCs are effective, a single test of one instance ('benchmarking') may suffice.

Distinguish testing the design effectiveness from testing the operating effectiveness of a control.

Design effectiveness: whether the control, if operating as intended, would prevent or detect material misstatements. Operating effectiveness: whether the control actually operated as designed over the period (consistently, by authorized persons).

List common procedures for testing operating effectiveness of controls, from least to most persuasive.

Inquiry (least persuasive), observation, inspection/examination of evidence, and reperformance (most persuasive). Inquiry alone is never sufficient to test operating effectiveness.

How does the frequency of a control affect the auditor's sample size?

Generally, the more frequently a control operates, the larger the sample needed. For example, a control operating many times daily requires a larger sample than an annually performed control (which may need a sample of one).

Differentiate a control deficiency, a significant deficiency, and a material weakness.

Control deficiency: control fails to prevent/detect misstatements timely. Significant deficiency: important enough to merit attention by those charged with governance. Material weakness: reasonable possibility of a material misstatement not being prevented/detected.

When evaluating an IT control deficiency, what two factors determine its severity?

The likelihood (could a misstatement occur?) and the magnitude/potential impact (how large could the misstatement be?). Compensating controls may reduce the severity of an identified deficiency.

What is a compensating control?

An alternative control that mitigates the risk created by a deficient or missing primary control. It can reduce the severity of a deficiency but must be evaluated for its own effectiveness.

What does a SOC 1 engagement report on, and under what standard?

A SOC 1 reports on a service organization's controls relevant to a user entity's internal control over financial reporting (ICFR). It is performed under SSAE 18 (AT-C section 320).

Who are the intended users of a SOC 1 report?

Restricted-use report: management of the service organization, user entities (customers), and the user entities' auditors. It is not for general public distribution.

What does a SOC 2 report address, and to whom is it provided?

SOC 2 reports on controls relevant to the Trust Services Criteria (security, availability, processing integrity, confidentiality, privacy). It is a restricted-use report for knowledgeable parties (customers, regulators, partners).

List the five Trust Services Criteria categories used in SOC 2.

Security (the only mandatory/common criteria), Availability, Processing Integrity, Confidentiality, and Privacy. The service organization selects which apply beyond Security.

Which Trust Services Criterion is always included in a SOC 2 engagement?

Security (also called the 'common criteria'). The other four (availability, processing integrity, confidentiality, privacy) are optional and selected based on the services provided and user needs.

Contrast SOC 2 with SOC 3 reports.

Both use the Trust Services Criteria, but SOC 2 is a detailed, restricted-use report (includes the auditor's tests and results). SOC 3 is a short, general-use report suitable for public distribution (no detailed test results).

Distinguish a Type 1 from a Type 2 SOC report.

Type 1: reports on the fairness of the description and suitability of control design at a point in time. Type 2: also tests and reports on the operating effectiveness of controls over a period of time (typically 6–12 months).

Why does a user auditor generally prefer a Type 2 over a Type 1 SOC report?

A Type 2 provides evidence that controls operated effectively over a period, which the user auditor can use to reduce control risk. A Type 1 only covers design at a point in time and gives no operating-effectiveness assurance.

What are complementary user entity controls (CUECs)?

Controls the service organization assumes the user entity (customer) will implement for the service organization's controls to achieve the control objectives/criteria. The user entity is responsible for these, and the user auditor must consider them.

What is a subservice organization, and what are the two methods of addressing it in a SOC report?

A subservice organization is a vendor used by the service organization to perform some services. The two methods: the inclusive method (subservice controls described/tested in the report) and the carve-out method (subservice excluded, relying on CSOCs).

Define complementary subservice organization controls (CSOCs).

Under the carve-out method, CSOCs are controls the service organization assumes the subservice organization has implemented (and excludes from its own report) that are necessary to meet the control objectives or trust services criteria.

What is the difference between the inclusive and carve-out methods for subservice organizations?

Inclusive method: the subservice organization's relevant controls are described and tested within the service organization's SOC report. Carve-out method: those controls are excluded from the description and testing, with reliance placed on CSOCs.

Define encryption and contrast symmetric with asymmetric encryption.

Encryption converts plaintext into unreadable ciphertext using a key. Symmetric: same key encrypts and decrypts (fast, key-distribution challenge). Asymmetric: a public/private key pair (public encrypts, private decrypts) enabling secure exchange and digital signatures.

What is a firewall and how does it differ from an intrusion detection system (IDS)?

A firewall filters and controls network traffic based on rules (preventive). An IDS monitors traffic and alerts on suspicious activity (detective). An IPS (intrusion prevention system) can also actively block detected threats.

What is change management and what are its key control steps?

A formal ITGC process for controlling modifications to systems. Key steps: request and authorization, testing in a non-production environment, approval, and controlled migration to production by independent personnel — with documentation throughout.

What is a business impact analysis (BIA) in continuity planning?

A BIA identifies critical business functions and processes, the impact of their disruption over time, and recovery priorities. It drives the setting of RTOs and RPOs and the allocation of recovery resources.