Print-ready PDF: 1080x1350 portrait, math pre-rendered, fonts embedded. Download once, study anywhere.
Download PDF →
All CPA ISC Formulas
Information Systems and Data Management
17 items
RPO vs. RTO
RPO (Recovery Point Objective): max acceptable data loss.
RTO (Recovery Time Objective): max acceptable downtime.
RPO drives backup frequency; RTO drives recovery infrastructure.
MTBF and system availability
MTTR = Mean Time to Repair.
Data classification levels
Government: Top Secret → Secret → Confidential → Unclassified.
Commercial: Restricted → Confidential → Internal → Public.
Drives access controls, handling, and retention.
Backup site tiers
Cold: basic infrastructure only, lowest cost, RTO days–weeks.
Warm: partial equipment, moderate cost, RTO hours–days.
Hot: fully mirrored, highest cost, RTO minutes–hours.
Database normalization — first three normal forms
1) 1NF: atomic values, no repeating groups. 2) 2NF: 1NF + no partial dependencies. 3) 3NF: 2NF + no transitive dependencies.
Application input controls (examples)
Edit checks, validation rules, batch totals, completeness checks. Application controls supplement ITGCs at the transaction level.
Application processing controls (examples)
Run-to-run totals, control totals, logic checks, exception reports.
Application output controls (examples)
Distribution restrictions, reconciliation, error-log review.
Software development methodologies — Waterfall vs Agile vs DevOps
Waterfall: sequential phases, rigid, stable reqs. Agile: iterative sprints, flexible, changing reqs. DevOps: dev+ops integration, CI/CD, automated test/deploy.
Cloud computing service models (IaaS / PaaS / SaaS)
Customer-managed layers: IaaS = OS + runtime + apps + data; PaaS = apps + data only; SaaS = data/config only. Provider manages everything below the customer's layer.
System Development Life Cycle (SDLC) — 7 phases
1) Planning/feasibility 2) Requirements analysis 3) System design 4) Development/coding 5) Testing/QA 6) Implementation/deployment 7) Maintenance. ITGC change mgmt covers phases 3-6.
ETL vs ELT vs Data Warehouse vs Data Lake
ETL: Extract→Transform→Load (structured DW). ELT: Extract→Load→Transform (load raw, transform in lake). DW: structured, schema-on-write. Lake: raw/unstructured, schema-on-read.
Data lifecycle stages (CRUD-DD)
Stages: 1) Create 2) Read 3) Update 4) Delete 5) Disclosure 6) Destruction. Delete = logical removal; Destruction = sanitize via overwrite, degauss, or physical destruction.
Business Impact Analysis (BIA) — required outputs
BIA outputs: critical processes + dependencies, MTD (max tolerable downtime), RTO, RPO, resource needs, financial + operational impact. Constraint: RTO ≤ MTD.
Cloud deployment models (public / private / community / hybrid)
Public = shared infra, multi-tenant. Private = dedicated to one org. Community = shared by orgs w/ common concerns. Hybrid = public + private orchestrated together.
Disaster Recovery sites — hot vs warm vs cold
Hot = fully equipped + live data, RTO minutes to hours, highest cost. Warm = HW/network ready, no current data, RTO hours to a day. Cold = facility + utilities only, RTO days to weeks, lowest cost.
IT General Controls (ITGCs) — 4 domains
1) Logical Access 2) Change Mgmt 3) IT Operations 4) SysDev/Acquisition. ITGCs support reliance on app-level controls.
Security, Confidentiality and Privacy
16 items
Information security risk formula
Controls reduce vulnerability or impact. Risk = residual risk after controls applied.
Annual loss expectancy (ALE)
= Single Loss Expectancy, = Annualized Rate of Occurrence.
NIST password guidelines (SP 800-63B)
Min length 8 (15 for admin).
No complexity rules.
No forced rotation unless compromise.
Screen against breached passwords.
Allow paste + password managers.
Encryption key sizes and strength
AES-128 adequate; AES-256 for sensitive.
RSA-2048 min; RSA-4096 long-term.
ECC-256 RSA-3072.
NIST: 112-bit min through 2030; 128-bit beyond.
Public Key Infrastructure (PKI) components
PKI: 1) CA issues+signs certs 2) RA verifies identity pre-issue 3) X.509 Digital Certificates 4) CRL/OCSP for revocation 5) Public/Private key pair. Enables SSL/TLS, S/MIME, code signing.
Encryption deployment — at rest vs in transit
At Rest: full-disk, DB-level (TDE), file-level, AES-256 standard. In Transit: TLS 1.2+ (HTTPS), IPsec VPN, S/MIME or PGP email. Deploy BOTH.
Network defense layers — defense in depth
7 layers: 1) Perimeter 2) Network 3) Endpoint 4) Application 5) Data 6) Identity 7) Physical.
Cryptography — symmetric vs asymmetric vs hashing
Symmetric: same key encrypts+decrypts, fast, key-distribution problem. Asymmetric: public/private pair, slower, key exchange + digital signatures. Hashing: one-way, fixed-length, integrity.
Privacy regulations — GDPR + CCPA + HIPAA
GDPR (EU): consent + access/delete/portability, 72-hr breach notice, fines ≤4% global revenue. CCPA (CA): know/delete/opt-out of sale. HIPAA (US health): breach notice ≤60 days.
NIST Cybersecurity Framework — 5 functions (IPDRR)
IPDRR: 1) Identify 2) Protect 3) Detect 4) Respond 5) Recover. Outcome-based; voluntary.
Data Loss Prevention (DLP) categories
Network DLP: inspects data in motion. Endpoint DLP: agent on devices. Storage/Cloud DLP: discovers + classifies data at rest. Prevents exfiltration.
Authentication factors — types + MFA
3 factors: KNOW (password, PIN), HAVE (token, smartcard), ARE (biometric). MFA = 2+ different factors.
Firewall types — stateful vs stateless vs WAF vs NGFW
Stateless: per-packet ACL match, no session memory. Stateful: tracks connection state. WAF: inspects HTTP/HTTPS at app layer. NGFW: stateful + DPI + IDS/IPS + app awareness + user identity.
CIA triad
Confidentiality: only authorized parties see data. Integrity: data accurate & unaltered. Availability: systems usable when needed.
Common attack vectors — top 5
1) Phishing/social engineering 2) Malware 3) SQL Injection 4) XSS 5) DDoS
Incident response phases (PICERL)
NIST SP 800-61: 1) Preparation 2) Identification 3) Containment 4) Eradication 5) Recovery 6) Lessons Learned.
Considerations for SOC Engagements
6 items
SOC report types
SOC 1: ICFR, for FS auditors.
SOC 2: Trust Services Criteria.
SOC 3: Public summary of SOC 2.
Type I = design (point in time). Type II = design + operating effectiveness (period).
Carve-out vs inclusive method (subservice organizations)
Carve-out: subservice controls EXCLUDED from SOC report; user obtains separate SOC for subservice. Inclusive: subservice controls INCLUDED. Carve-out = most common.
Trust Services Criteria (TSC) — 5 categories
TSC: Security (required for ALL SOC 2), Availability, Processing Integrity, Confidentiality, Privacy. Service org picks beyond Security.
Service organization controls — bridge letter
Bridge (gap) letter from service org covering SOC report period-end → current date. Asserts: no material changes to controls, no significant incidents/breaches. Max gap ~6 months.
SOC report Type 1 vs Type 2
Type 1: DESIGN of controls at a point in time. Type 2: DESIGN + OPERATING EFFECTIVENESS over a period (6-12 months); preferred by user auditors.
SOC 1 vs SOC 2 vs SOC 3 — purpose + audience
SOC 1: ICFR at service org; audience = user auditors (restricted). SOC 2: Trust Services Criteria; audience = mgmt + customers (restricted). SOC 3: same TSC as SOC 2; public/general use.
