Cybersecurity Frameworks and Controls
Cybersecurity is a critical area on the ISC section of the CPA exam. CPAs must understand common threats, defensive frameworks, encryption techniques, and privacy regulations to evaluate organizational security posture.
NIST Cybersecurity Framework
| Function | Purpose | Key Activities |
|---|
| Identify | Understand the business context and cybersecurity risk | Asset management, business environment, governance, risk assessment, risk management strategy |
| Protect | Implement safeguards for critical services | Access control, awareness and training, data security, information protection processes, maintenance, protective technology |
| Detect | Identify cybersecurity events in a timely manner | Anomalies and events, continuous security monitoring, detection processes |
| Respond | Take action regarding a detected cybersecurity event | Response planning, communications, analysis, mitigation, improvements |
| Recover | Restore capabilities impaired by a cybersecurity event | Recovery planning, improvements, communications |
Encryption Quick Reference
| Type | Keys Used | Speed | Common Algorithms | Best For |
|---|
| Symmetric | One shared key | Fast | AES, DES, 3DES, Blowfish | Bulk data encryption, data at rest |
| Asymmetric | Public + Private key pair | Slow | RSA, ECC, DSA | Digital signatures, key exchange, authentication |
| Hashing | No key (one-way) | Very fast | SHA-256, SHA-3, MD5 (deprecated) | Data integrity, password storage |
Common Cyber Threats
| Threat | Description | Primary Defense |
|---|
| Phishing | Deceptive messages to steal credentials or install malware | Security awareness training, email filtering, MFA |
| Ransomware | Encrypts data; demands payment for decryption | Backups, endpoint protection, network segmentation |
| SQL Injection | Malicious code inserted into database queries via application inputs | Input validation, parameterized queries, WAF |
| Man-in-the-Middle | Intercepting communications between two parties | TLS/SSL, certificate validation, VPN |
| Insider Threat | Malicious or negligent actions by authorized users | Least privilege, monitoring, separation of duties |
| DDoS | Overwhelming systems with traffic to cause outages | DDoS mitigation services, load balancing, redundancy |
SOC Reports Reference
| Report | Focus | Audience |
|---|
| SOC 1 (Type I/II) | Controls relevant to user entities' ICFR | User entities and their auditors |
| SOC 2 (Type I/II) | Trust Services Criteria (security, availability, processing integrity, confidentiality, privacy) | Management, regulators, business partners |
| SOC 3 | Same as SOC 2 but summarized | General public |
Type I: Design of controls at a point in time. Type II: Design AND operating effectiveness over a period (typically 6-12 months). Type II provides more assurance.
Data Privacy Regulations Summary
| Regulation | Scope | Key Requirements |
|---|
| GDPR | EU data subjects | Consent, right to erasure, 72-hour breach notification, DPO requirement |
| CCPA/CPRA | California consumers | Right to know, delete, and opt out of data sale |
| HIPAA | US healthcare (PHI) | Administrative, physical, and technical safeguards for PHI |
| PCI DSS | Payment card data | 12 requirements for securing cardholder data environments |
Practice cybersecurity questions with ISC mini exams and build fluency with CPA flashcards. Sign up free to access all study tools.