United States · Licensing examWhat's on the ISC section
The first two areas weigh the same, 35% to 45% each, and SOC engagements make up the rest at 15% to 25%.
| Area | Weight |
|---|---|
| I. Information systems and data management | 35-45% |
| II. Security, confidentiality and privacy | 35-45% |
| III. Considerations for system and organization controls (SOC) engagements | 15-25% |
Skill levels tested
| Skill | Weight |
|---|---|
| Remembering and understanding | 55-65% |
| Application | 20-30% |
| Analysis | 10-20% |
What is the ISC CPA exam format?
Two multiple-choice testlets of 41 questions each, then three simulation testlets of 1, 3 and 2 simulations.
ISC is scored differently from the other five sections: multiple choice counts for 60% and simulations for 40%. Like every Discipline, it only runs in testing windows.
What the ISC section focuses on
The Blueprint names processing integrity, availability, security, confidentiality and privacy, plus data extraction, storage and use. For SOC engagements, it centers on SOC 2 work using the Trust Services Criteria.
What changes in ISC for 2027
The 2027 Blueprint narrows blockchain: it removes one task, rewrites another and drops two blockchain and COSO references. The AICPA says the scope doesn't significantly change.
Sources: AICPA · AICPA & CIMA and 2 more. Checked October 2026.
- AICPA: Uniform CPA Examination Blueprints, effective January 1, 2026 (PDF) ↗
- AICPA & CIMA: CPA Exam Blueprints (2026 and 2027) ↗
- AICPA: Summary of changes to the Blueprints, effective January 1, 2027 (PDF) ↗
- AICPA & CIMA: CPA Exam frequently asked questions ↗
Rules and fees can change, so check the official site before your test.