17.1 Security Threats and Control Selection

Uniform CPA Examination Exam

Track your progress as you read

Finished sections get a check mark.

1 Chapter 1: CPA Exam Structure and Licensure Rules

1.1 CPA Evolution Model 1.2 Eligibility, Credit Window, and Scheduling Rules 1.3 Scoring, Pass Rates, and Blueprints

2 Chapter 2: CPA Scoring, Interface, and Exam Strategy

Score Scale and Testlets MCQ/TBS Weighting by Section Sample Test Interface Tools Exam-Day Time Management

3 Chapter 3: AUD Ethics, Independence, and Engagement Acceptance

3.1 Professional Responsibilities and Independence 3.2 Engagement Acceptance and Continuance 3.3 Audit Documentation and Quality Management 3.4 Audit Risk Foundations

4 Chapter 4: AUD Risk Assessment, Controls, and Evidence

4.1 Assertions and Risk Assessment 4.2 Internal Control Design and Operating Effectiveness 4.3 Substantive Procedures and Audit Evidence 4.4 Sampling, Analytics, and Estimates

5 Chapter 21: AUD Sampling, Analytics, and Accounting Estimates

21.1 Audit Sampling Risk and Sample Design 21.2 Substantive Analytical Procedures 21.3 Estimates, Fair Value, and Specialists 21.4 Data Analytics, Exceptions, and Follow-Up

6 Chapter 22: AUD Integrated Audits, IT Controls, and SOC Reliance

22.1 ICFR Integrated Audit Framework 22.2 IT General Controls and Application Controls 22.3 Service Organizations, SOC Reports, and CUECs 22.4 Control Deficiencies and Material Weaknesses

7 Chapter 5: AUD Reporting, Attestation, and Review Engagements

5.1 Audit Opinions and Modifications 5.2 Emphasis, Other Matter, and Going Concern 5.3 Review, Compilation, and Preparation Engagements 5.4 Attestation and Government Auditing Signals

8 Chapter 36: AUD Workbook - From Risk to Report

36.1 Risk-Assertion-Procedure Drill 36.2 Evidence Reliability Drill 36.3 Control Deficiency Classification Drill 36.4 Report Modification Decision Drill

9 Chapter 6: FAR Financial Statements and Reporting Framework

6.1 Conceptual Framework and Standard Setting 6.2 Financial Statement Presentation 6.3 Cash Flow Statement and Disclosures 6.4 Not-for-Profit Reporting Basics

10 Chapter 7: FAR Balance Sheet Accounts and Rollforwards

7.1 Cash, Receivables, and Reconciliations 7.2 Inventory and Cost Flow Errors 7.3 Property, Equipment, and Intangibles 7.4 Debt, Equity, and Contingencies

11 Chapter 8: FAR Selected Transactions and Measurement Models

8.1 Revenue Recognition: Five-Step Model 8.2 Leases, Income Taxes, and Impairment 8.3 Business Combinations and Consolidations 8.4 Accounting Changes, Errors, and Subsequent Events

12 Chapter 32: FAR Revenue, Leases, and Income Taxes Deep Dive

32.1 Revenue Contract Modifications and Variable Consideration 32.2 Lease Classification and Lessee Accounting 32.3 Deferred Tax Assets, Liabilities, and Valuation Allowances 32.4 Simulation Workflows for Revenue, Lease, and Tax Exhibits

13 Chapter 31: FAR Financial Instruments, Fair Value, and Derivatives

31.1 Financial Asset Classification and Measurement 31.2 Fair Value Hierarchy and Disclosures 31.3 Derivatives, Hedge Accounting, and Embedded Features 31.4 Foreign Currency and Comprehensive Income Signals

14 Chapter 24: FAR Consolidations, Equity Method, and Intercompany Workpapers

24.1 Consolidation Decision and Noncontrolling Interest 24.2 Acquisition-Date Measurement and Goodwill 24.3 Equity Method Income, Dividends, and Impairment 24.4 Intercompany Inventory, Debt, and Fixed Asset Eliminations

15 Chapter 9: FAR Governmental Accounting and Fund Reporting

9.1 Governmental Fund Types and Basis 9.2 Government-Wide Statements and Reconciliations 9.3 Budgetary Accounting and Encumbrances 9.4 Governmental and NFP Comparison Traps

16 Chapter 23: FAR Not-for-Profit and Special Reporting Topics

23.1 Not-for-Profit Net Assets and Restrictions 23.2 Contributions, Conditional Gifts, and Agency Transactions 23.3 Functional Expenses and Statement Presentation 23.4 Interim, Segment, and EPS Reporting Traps

17 Chapter 37: FAR Workbook - Journal Entries, Rollforwards, and Reconciliations

Adjusting Entry Workflow Account Rollforward Workflow Reconciliation and Error Correction Drill Statement Presentation Workpaper Drill

18 Chapter 10: REG Tax Procedure, Ethics, and Business Law

10.1 Tax Practice Ethics and Preparer Responsibilities 10.2 IRS Procedure, Statutes, and Penalties 10.3 Contracts, Agency, and Business Entities 10.4 Secured Transactions, Bankruptcy, and Priority

19 Chapter 11: REG Individual Federal Tax Workflows

11.1 Gross Income, Exclusions, and Adjustments 11.2 Filing Status, Dependents, and Deductions 11.3 Credits, Payments, and AMT Concepts 11.4 Retirement, Passive Activity, and Loss Limitations

20 Chapter 12: REG Property Transactions and Entity Taxation

12.1 Basis, Realized Gain, Recognized Gain, and Character 12.2 C Corporations and Shareholder Transactions 12.3 S Corporations, Partnerships, and Basis 12.4 Entity Tax Simulations and K-1 Workflows

21 Chapter 25: REG Entity Choice, Basis, and Owner Tax Consequences

25.1 C Corporation, S Corporation, and Partnership Comparison 25.2 Formation Contributions and Built-In Gain 25.3 Distributions, Redemptions, and Liquidations 25.4 Loss Limits: Basis, At-Risk, and Passive Rules

22 Chapter 26: REG Property Tax, Character, and Deferral Transactions

26.1 Capital, Ordinary, and Section 1231 Character 26.2 Depreciation Recapture and Unrecaptured Gain 26.3 Like-Kind Exchanges, Involuntary Conversions, and Installment Sales 26.4 Related-Party, Wash-Sale, and Imputed-Interest Traps

23 Chapter 33: REG Trusts, Estates, Gifts, and Exempt Organizations

33.1 Trust and Estate Income Tax Basics 33.2 Gift, Estate, and Beneficiary Planning Concepts 33.3 Tax-Exempt Organizations and Unrelated Business Income 33.4 Fiduciary K-1 and Distribution Simulation Workflows

24 Chapter 38: REG Workbook - Tax Return Schedules and Basis Workpapers

38.1 Individual Return Classification Drill 38.2 Property Basis and Character Workpaper 38.3 Pass-through K-1 and Owner Basis Workpaper 38.4 Business Law Issue Spotting Drill

25 Chapter 13: BAR Business Analysis, Economics, and Forecasting

13.1 Financial Statement Analysis and Ratios 13.2 Variance, Forecasting, and Budgeting 13.3 Cost Accounting and Performance Management 13.4 Economics, Finance, and Decision Models

26 Chapter 14: BAR Technical Accounting and Advanced Reporting

14.1 Revenue, Leases, and Complex Arrangements 14.2 Derivatives, Hedges, and Fair Value 14.3 Business Combinations and Consolidations 14.4 SEC Reporting and Public Company Context

27 Chapter 15: BAR State and Local Government Analysis

15.1 Governmental Fund Analysis 15.2 Government-Wide Conversion Workflows 15.3 Budgetary Reconciliation and CAFR/ACFR Reading 15.4 Government Simulation Strategy

28 Chapter 16: ISC Information Systems and Data Management

16.1 Systems Architecture and Data Flow 16.2 ERP, Accounting Systems, and Change Management 16.3 Data Governance, SQL, and Analytics 16.4 Availability, Backup, and Recovery Controls

29 Chapter 17: ISC Security, Privacy, and SOC Engagements

17.1 Security Threats and Control Selection 17.2 Privacy, Confidentiality, and Compliance Frameworks 17.3 SOC 1, SOC 2, SOC 3, and Cybersecurity Reports 17.4 Service Organization Exceptions and User Controls

30 Chapter 18: TCP Individual Tax Planning and Personal Financial Issues

18.1 Nonroutine Individual Income and Estimated Tax 18.2 Passive, At-Risk, and Investment Planning 18.3 Retirement, Education, and Insurance Planning 18.4 Gift, Estate, and Beneficiary Concepts

31 Chapter 19: TCP Entity Compliance and Planning

19.1 C Corporation Tax Planning 19.2 S Corporation Basis and Distributions 19.3 Partnership Tax Planning and Allocations 19.4 Trusts, Tax-Exempt, and International Signals

32 Chapter 34: TCP International and Advanced Entity Tax Topics

34.1 International Tax Signals and Source of Income 34.2 CFC, Foreign Tax Credit, and Permanent Establishment Concepts 34.3 Consolidated Returns and Affiliated Corporations 34.4 Advanced Partnership and S Corp Planning Scenarios

33 Chapter 35: Choosing and Preparing for BAR, ISC, or TCP

35.1 Discipline Fit Matrix by Background 35.2 BAR, ISC, and TCP Blueprint and Skill Comparison 35.3 Discipline Study Plans and Practice Balance 35.4 Switching Disciplines, Retake, and Score Interpretation

34 Chapter 39: CPA TBS Research, Authoritative Literature, and Document Review

39.1 Document Review Simulation Method 39.2 Research and Authoritative Literature Workflow 39.3 Exhibit Overload and Relevant Data Selection 39.4 Written Explanation and Professional Judgment Drills

35 Chapter 20: CPA Simulations, Retakes, and Final Review

20.1 TBS Exhibit Triage and Workpaper Method 20.2 Section-Specific Final Review Plans 20.3 Score Release, Retake, and Credit Window Decisions 20.4 Four-Section Study Roadmaps

36 Chapter 40: Discipline Workbook Drills for BAR, ISC, and TCP

40.1 BAR Ratio, Variance, and Government Drill 40.2 ISC Control Evidence and SOC Drill 40.3 TCP Basis Planning and Entity Drill 40.4 Discipline Final Mock and Review Log

17.1 Security Threats and Control Selection

Key Takeaways Explain This Topic AI

Area II (Security, Confidentiality, and Privacy) is 35-45% of the ISC discipline; candidates classify threat agents, attack types, techniques, and the stages of a cyber-attack before selecting controls.

Cloud, Internet of Things, mobile, remote access, and vendor connections each create distinct attack surfaces that must be mapped to the system boundary.

Defense-in-depth layers preventive, detective, and corrective controls rather than relying on one technology to stop every attack path.

Least privilege, need-to-know, zero trust, and whitelisting are access design principles that drive authentication, authorization, and monitoring choices.

In SOC 2 and IT advisory scenarios, a CPA distinguishes a control design deficiency from an operating deviation and documents the exception, criterion, evidence, and recommendation.

Last updated: June 2026

Blueprint Focus

The ISC (Information Systems and Controls) discipline is one of three CPA exam discipline sections, alongside BAR and TCP. ISC is delivered as a four-hour exam with about 82 multiple-choice questions and 6 task-based simulations, scored on the 0-99 scale with a passing score of 75. Area II, Security, Confidentiality, and Privacy, carries 35-45% of the score and treats security as far more than a vocabulary list: a newly licensed CPA must recognize threat agents, attack methods, and the controls management uses to prevent, detect, and respond to them.

The exam embeds these ideas in an IT audit, SOC 2, vendor-risk, or advisory setting. Three terms anchor every question. A threat agent is the source of potential harm: internal or external, state-sponsored or non-state, a malicious actor, or an employee who creates exposure through error. A threat is the circumstance that can exploit a weakness; a vulnerability is the weakness itself; and risk is the likelihood and impact of the threat exploiting the vulnerability.

Threats, Attacks, and Techniques

Attack types include physical attacks, distributed denial-of-service (DDoS) attacks, malware, social engineering, web-application attacks, and mobile-device attacks. Techniques include SQL injection, cross-site scripting (XSS), buffer overflow, replay attacks, covert channels, race conditions, mobile code, and return-oriented programming. In a scenario, first decide whether the attacker is trying to steal credentials, disrupt service, execute code, bypass authorization, or alter data.

A cyber-attack typically progresses through stages: reconnaissance, gaining access, privilege escalation, maintaining access, network exploitation, and covering tracks. ISC questions hide the stage inside the facts. Unusual administrative-account creation signals privilege escalation; deletion of security logs signals covering tracks; scanning exposed ports signals reconnaissance; a planted backdoor or scheduled task signals maintaining access.

Risk Environment

Cloud, IoT, mobile, and partner connections expand the attack surface. Cloud risk involves misconfigured storage buckets, weak identity federation, insecure application programming interfaces (APIs), and unclear shared responsibility between customer and provider. IoT risk centers on default passwords, limited patching, unmanaged devices, and weak network segmentation. Mobile risk includes lost devices, untrusted networks, malicious apps, and bring-your-own-device data leakage.

Risk condition Likely control response

Remote access from personal devices Multi-factor authentication, VPN, managed endpoint security, session logging

• Flat internal network Segmentation, firewall rules, least-privilege access paths
• Unpatched critical software Vulnerability scanning, patch prioritization, testing, deployment evidence
• Public web-application input Secure coding, input validation, web-application firewall, code review
• Excessive user permissions Role-based access, periodic access recertification, account restrictions
• Control Selection

Apply defense-in-depth to layer controls so no single failure exposes the system. Preventive controls reduce the chance of an event: system hardening, access restrictions, application whitelisting, and intrusion prevention. Detective controls identify events during or after occurrence: log analysis, intrusion detection, monitoring alerts, and security information and event management (SIEM) review. Corrective controls contain or restore: patching, malware quarantine, backup restoration, and incident response.

Access design should reflect least privilege (only the access a job needs), need-to-know , and zero trust (never trust, always verify, even inside the perimeter). Discretionary access lets owners grant rights; role-based access ties rights to job duties; mandatory access enforces centrally defined classifications. Authentication methods include passwords, single sign-on, multi-factor authentication, digital signatures, smart cards, biometrics, and PIN controls.

CPA Testing Lens

When evaluating controls, separate design from operation. A design deficiency exists when a control, even if performed perfectly, would not address the risk. An operating deviation exists when a suitably designed control was not performed as designed. In a SOC 2 security scenario, document the issue, the affected criterion or service commitment, the evidence reviewed, the exception population, the risk implication, and a recommendation. The best exam answer is usually the control that addresses the stated risk most directly with the fewest unsupported assumptions.

Worked Scenario: Mapping an Attack to Layered Controls

A simulation describes a SaaS provider whose customer-facing application accepts unvalidated text in a search box, and an attacker submits a crafted string that returns other customers' records. Walk the facts in order. The technique is SQL injection , a web-application attack that abuses missing input validation to manipulate a database query. The blueprint expects you to pair it with layered controls rather than a single fix.

Preventive: parameterized queries (prepared statements), server-side input validation, secure-coding standards, and a web-application firewall to filter known injection patterns.

Detective: SIEM alerting on anomalous query patterns, database activity monitoring, and code review or static analysis in the build pipeline.

Corrective: incident response to contain the session, a patch to the vulnerable code, and forensic review of which records were exposed.

Notice that the answer is never "buy a tool." It is "close the design gap (validation) and add detection and response in case prevention fails." That layering is the testable point.

Common Traps

ISC multiple-choice items plant predictable distractors. Watch for these:

A control that sounds relevant but addresses a different attack stage (training will not stop an active SQL injection).

Confusing a vulnerability (the weakness) with a threat (the circumstance) or with risk (likelihood times impact).

Naming a detective control when the stem asks how to prevent an event, or vice versa.

Treating multi-factor authentication as a cure-all when the real gap is excessive standing privilege, where least privilege and access recertification are the better answers.

Selecting the broadest, most expensive control instead of the one that directly addresses the stated risk with the fewest assumptions.

The disciplined method is constant: identify the threat agent and attack stage, name the vulnerability, then choose the preventive, detective, or corrective control the stem actually calls for.