US CPA ISC (Information Systems and Controls) — Complete Guide 2026
US CPA ISC exam guide: the CPA Evolution ISC discipline section on information systems, IT controls and SOC reports — syllabus, exam format, and whether ISC is the right discipline choice for you.
Information Systems and Controls (ISC) is one of three Discipline sections of the US CPA exam, alongside BAR and TCP. According to the AICPA blueprint effective January 2026, it lasts four hours and contains 82 multiple-choice questions and 6 task-based simulations. It is the only section where the multiple-choice questions count for 60 percent of the score. The AICPA reports a cumulative pass rate of 67.45 percent for the first two quarters of 2026. This guide covers the structure, the three content areas, what the Discipline rule means for your choice and how ISC is scored. See our BAR guide and TCP guide for the alternatives, and our how to become a US CPA for the route to licensure.
At a glance
| Item | What the official sources say |
|---|---|
| Section type | Discipline: candidates choose one of BAR, ISC or TCP |
| Time | Four hours |
| Multiple-choice questions | 82, in two testlets of 41 |
| Task-based simulations | 6, in three testlets of 1, 3 and 2 |
| Score weighting | 60 percent multiple-choice, 40 percent simulations |
| Information Systems and Data Management | 35 to 45 percent |
| Security, Confidentiality and Privacy | 35 to 45 percent |
| Considerations for System and Organization Controls (SOC) Engagements | 15 to 25 percent |
| Scheduling | Only in the first month of each quarter |
| Pass rate (AICPA) | 67.79 percent for 2025; 67.45 percent for the first two quarters of 2026 |
What ISC covers
ISC has three areas. Information Systems and Data Management, and Security, Confidentiality and Privacy, are each weighted 35 to 45 percent. Considerations for System and Organization Controls engagements are weighted 15 to 25 percent. The section suits candidates who work in audit, risk or technology and want a Discipline that matches that work.
Exam structure
The section has five testlets. Two multiple-choice testlets carry 41 questions each, making 82, and three simulation testlets carry 1, 3 and 2 tasks, making 6. The AICPA weights ISC at 60 percent multiple choice and 40 percent simulations, whereas every other section is weighted evenly. That makes the multiple-choice testlets more important here.
Discipline scheduling
The NASBA FAQ says Discipline sections, which are BAR, ISC and TCP, can only be scheduled in the first month of each quarter. Core sections can be scheduled year-round. A failed ISC attempt can therefore mean a wait of several months, so plan your first attempt with the quarterly windows in mind. Our retake and credit window guide explains how retakes and credit periods work.
Sources
The blueprint lists the references ISC may test, including the COSO framework, HIPAA, ISACA COBIT 2019, the NIST Cybersecurity Framework, NIST SP 800-53, PCI DSS and parts of the GDPR. As with every section, material outside the listed references is not eligible.
How hard is ISC?
The AICPA reports 67.79 percent for 2025 and 67.45 percent for the first two quarters of 2026. In 2025 the quarterly figures ranged from 61.23 percent in Q1 to 71.96 percent in Q2. ISC and TCP are the two highest pass rates of the six sections, though a pass rate is an average across all candidates and says little about any one person. Our CPA pass rates guide compares the sections.
Choosing between BAR, ISC and TCP
The AICPA does not recommend one Discipline over another, and your state board decides what counts for licensure, so check your board before you commit. Choose by what you know and what you do at work. Our BAR guide covers business analysis, and our TCP guide covers tax compliance and planning.
Scoring
Scores run from 0 to 99 with a pass mark of 75. Our CPA exam scoring guide covers release timing and the score report.
Frequently asked questions
How many questions are on the CPA ISC exam?
82 multiple-choice questions and 6 task-based simulations over four hours.
Why is ISC weighted differently?
The AICPA blueprint weights ISC at 60 percent multiple-choice and 40 percent simulations. Every other section is weighted 50 and 50.
When can I sit ISC?
Discipline sections can only be scheduled in the first month of each quarter, according to the NASBA FAQ.
What is the ISC pass rate?
The AICPA page reports 67.79 percent for 2025 and 67.45 percent for the first two quarters of 2026.
Can I choose ISC instead of BAR or TCP?
Yes. Candidates pass three Core sections and one Discipline section of their choice, subject to their state board's rules.
Next steps
Read the CPA syllabus guide and the registration and Notice to Schedule guide before you book. If you are comparing study options, see our Learnsignal pricing page and the CPA study materials comparison.
Source: AICPA and CIMA Uniform CPA Examination Blueprints effective January 2026, the AICPA exam structure pages and the NASBA CPA Exam Candidate Guide (September 2026). AICPA published pass rates are quarterly and cumulative, and the AICPA page we used is dated 15 July 2026 and includes the first two quarters of 2026 only. Checked October 2026.
This page was last updated:
Learnsignal Education Team
Expert Tutor at Learnsignal
Qualified professional with years of experience helping students advance their professional careers.
View all posts by Learnsignal Education Team
