Uniform CPA Examination — Information Systems and Controls (ISC)
The CPA Discipline for information systems, data, security and privacy, and SOC engagements.
About the exam
Information Systems and Controls (ISC) is one of three Discipline sections; you pass one of them, plus the three Core sections, to be licensed. ISC suits candidates heading into IT audit, systems assurance or advisory work: information systems and data management, security, confidentiality and privacy, and System and Organization Controls (SOC) engagements.
The section runs 4 hours in five testlets: two testlets of multiple-choice questions (82 in all) followed by 6 task-based simulations. ISC is the only section weighted 60% multiple choice and 40% simulations. As a Discipline section, it is offered only in January, April, July and October.
Our practice covers all three Blueprint areas with scenario questions on real control problems — which control fits the risk, which SOC report the user needs, which query returns the data. Add flashcards for frameworks and terms, case simulations that walk through an incident or a SOC engagement, and illustrated guides to networks, databases and the trust services criteria.
How we track your progress
Every blueprint domain moves through five levels as you study:
- Not startedNo questions answered in this domain yet.
- Getting startedFirst questions answered — not enough yet to judge.
- DevelopingAt least 5 answered and 50% or better on your recent questions.
- ProficientAt least 15 answered and 70% or better on your recent questions.
- Exam readyAt least 25 answered, 80% or better recently, and holding up on hard questions.
The exam blueprint
AICPA Uniform CPA Examination Blueprints, effective January 1, 2026 (Discipline section) — 3 content areas, each a set percentage range of the section. Tap a domain to see its topics.
1 Information Systems and Data Management 35–45% of the exam
181 practice questions in this domain so far
2 Security, Confidentiality and Privacy 35–45% of the exam
181 practice questions in this domain so far
3 Considerations for System and Organization Controls (SOC) Engagements 15–25% of the exam
88 practice questions in this domain so far
What you get when you access this exam
Free with your QuizMe account.
Questions built on the AICPA Blueprint
Every question is tagged to an ISC content area and Blueprint topic — IT infrastructure, availability, change management, SQL and data, security controls, privacy rules and SOC reports.
Hints that teach the rule
Reveal the concept behind the question — the framework, the control type, the SOC report it points to. Every answer comes with the full rationale.
Adaptive practice
Questions steer toward your weakest areas, weighted like the real exam, and get harder as you get stronger.
Timed practice exams
Blueprint-weighted multiple-choice exams — 82 questions in 105 minutes, the realistic MCQ share of your 4 hours — with a pacing indicator and full review.
Flashcards, case simulations and guides
120 flashcards, 8 unfolding case simulations in the spirit of task-based simulations — responding to an incident or scoping a SOC engagement where each decision changes the outcome — and interactive illustrated guides you explore hotspot by hotspot.
Progress in every content area
Each area moves from Not started to Exam ready, so you know exactly what to study next.
Test at home or at a center
The CPA Exam is given only at Prometric test centers — there's no online or at-home option. Apply through your state board (many use NASBA), get your Notice to Schedule (NTS), then book with Prometric. Discipline sections test only in the first month of each quarter — January, April, July and October — with one score release about six weeks after the window closes.
At a Prometric test center
- Seats fill fast in January, April, July and October — book as soon as your NTS arrives.
- Bring your NTS and unexpired government-issued photo ID with a name that matches it exactly.
- Phones, bags, watches and notes go in a locker; the exam has a built-in on-screen calculator — no personal calculators.
- Allow extra time for check-in and security checks before your 4-hour clock starts.
Exam-day game plan
How to walk in ready — and how to pace 82 multiple-choice questions — the MCQ share of the ISC section.
Pacing checkpoints
Checkpoints cover the two multiple-choice testlets (82 questions). The real section also has 6 task-based simulations in testlets 3–5 worth 40% of your score — save roughly 135 minutes for them. AICPA has announced a move to a new testing platform in 2027, with no testing planned July 1–11, 2027 and a slower score-release schedule for a while afterward — if you're planning around mid-2027, check AICPA's and NASBA's current notices.
The week before
- Take one full-length timed MCQ practice exam 3–5 days out, then rest.
- Compare SOC 1, SOC 2 and SOC 3, type 1 vs. type 2, and carve-out vs. inclusive subservice organizations.
- Refresh frameworks (COSO, COBIT, NIST CSF, ISO 27001) and privacy rules (HIPAA, GDPR, PCI DSS).
- Confirm your NTS, ID name match and Prometric appointment — and that your NTS hasn't expired.
During the exam
- Find the cue in the stem: preventive vs. detective, first step, best control for the risk.
- Keep moving — ISC has the most multiple-choice questions of any section, so watch your pace.
- Pick your best answer, flag it and move on — but review flags before you submit each testlet; you can't go back to it.
- Answer every question — there's no penalty for guessing.
Keep your head
- A few nerves sharpen focus. If you freeze, take three slow breaths and reread the question.
- Some questions are unscored pretest items you can't identify — one hard question tells you nothing.
- 75 is a scaled score against a fixed standard, not 75% correct and not a curve.
After you pass
- In most jurisdictions you now have 30 months from your first passed section to pass the rest (a few use 18 or 36) — check your board's rule and when its clock starts.
- To be licensed you need 3 Core sections plus 1 Discipline, along with your state's education and experience rules and, in most states, an ethics exam; licensed CPAs then complete state-set CPE (commonly about 120 hours every 3 years, including ethics).
- ISC pairs naturally with AUD — the IT controls and SOC content build on audit risk and internal control.
Official sources and further reading
- AICPA — Learn what is tested on the CPA Exam ↗Official Blueprints, summary of changes and the policy on when new standards and laws become testable.
- NASBA — CPA Exam information ↗Applying, the Notice to Schedule (NTS), fees and credit-window rules by jurisdiction.
Ready to start?
450 questions and scenarios across the blueprint — and growing.
Uniform CPA Examination® and AICPA® are trademarks of the American Institute of Certified Public Accountants. QuizMe and thinQtank Learning are not affiliated with or endorsed by the AICPA, NASBA, Prometric or any board of accountancy. Details are summarized from the AICPA's 2026 Exam Blueprints and NASBA's candidate information; fees and policies change — always confirm at aicpa-cima.com and nasba.org. Our Exam ready level asks for 80% or better.