Information Systems and Controls (ISC) is one of the three Discipline sections in the CPA Evolution model, taken alongside the three Core sections (AUD, FAR, REG) by candidates who choose the technology and assurance path to the US Certified Public Accountant license. The 2026 ISC blueprint is built around three weighted areas: Information Systems and Data Management (35 to 45%), Security, Confidentiality and Privacy (35 to 45%), and Considerations for System and Organization Controls (SOC) Engagements (15 to 25%). The section is anchored in IT audit and advisory work, especially SOC 1 and SOC 2 engagements and the AICPA Trust Services Criteria, and it leans heavily on recall and understanding, with roughly 55 to 65% of the section sitting at the Remembering and Understanding skill level. The single most important habit it tests is staying inside the blueprint's named References: the exam draws only on specific sections of specific standards (the Trust Services Criteria, NIST CSF, NIST SP 800-53, NIST Privacy Framework, CIS Controls v8.1, COBIT 2019, COSO guides, HIPAA, GDPR Articles 4 to 34, and the PCI DSS Quick Reference Guide), so answer from what those sources actually say rather than general IT practice.
What This Cheat Sheet Covers
This topic spans 27 focused tables and 280 indexed concepts, 222 flashcards, 9 practice tests with 353 questions. Below is a complete table-by-table outline of this topic, spanning foundational concepts through advanced details.
A jump-to index of every table row in this cheat sheet.
An interactive map of every table and concept in this topic.
Table 1: IT Architecture Components
ISC Area I-A.1 (IT infrastructure): explain the purpose and recognize examples of the key components of IT architecture, and frame each by its general IT control (GITC) and audit relevance. Each component is part of the IT environment an auditor maps when scoping access, change, and operations controls.
| Component | Example | Description | |
|---|---|---|---|
Windows Server, Linux, macOS mediating between an app and the disk/CPU | • The master control software that manages hardware and provides the platform applications run on; the kernel stays in memory. • Key access-control and patch surface for GITCs • Not an application: apps call the OS for file and user-interface operations | ||
A computer that stores files, processes queries, or manages network traffic for many clients | • A computer or device on a network that manages shared resources for client devices • Distinct roles (web, application, database, file, print) sit in different tiers, each with its own access and patch controls | ||
A SQL engine that processes database queries and returns rows | • A server that stores and processes the organization's data and answers queries. • Not the same tier as an application server • Holds the financially relevant data, so a top target for access and change controls | ||
The tier that runs business logic and calls the database server for data | • A server that runs application or business logic between the user and the data tier • Distinct from the database server it queries • mis-tiering the two creates gaps in access and patch controls | ||
Apache or IIS serving web pages over HTTP/HTTPS | • A computer that provides WWW services, including the hardware, OS, web server software, and site content • An internal-only web server is an intranet server | ||
Workstations, laptops, and mobile/BYOD phones used by staff | • The client hardware people use to access systems. • In scope of the IT environment an auditor maps (CIS Control 1 asset inventory) • An unmanaged device is an unmonitored entry point | ||
A smartphone or tablet a user carries, with its own storage and power | • A small portable computing device that operates wirelessly with local storage and a self-contained power source • A BYOD endpoint still inside the IT environment, often the hardest end-user layer to control | ||
A gateway forwarding IP packets between an office LAN and the internet | • A device that connects two or more networks at OSI Layer 3 and directs IP packets toward their destination. • Network infrastructure, not an end-user device • Works across networks, unlike a switch within one | ||
A device sending a frame out only the port leading to its destination on a LAN | A device that channels incoming data from many input ports to the one output port toward its destination, typically forwarding within a single LAN (OSI Layer 2). Not the same as a router, which links separate networks | ||
A gateway allowing or blocking traffic between an internal network and the internet | • A gateway that limits access between networks per the local security policy and controls traffic between zones of differing trust • A key perimeter and segmentation control, not an end-user device | ||
A Wi-Fi AP connecting laptops and phones to the wired enterprise network | • A device that connects wireless client devices to one another and to the wired distribution system • Network infrastructure that extends the wired network to mobile endpoints |