CPA ISC: Frameworks, confidentiality, privacy and incident response
Blueprint II.A, II.C, II.D · Area II, Security, Confidentiality and Privacy · 35–45% of ISC
Ten ISC questions on frameworks, confidentiality, privacy and incident response, untimed, with a reason for every answer option.
Or take the full ISC mock examA payment system replaces card numbers with random values and keeps the mapping in a secure vault. This technique is
Frameworks, confidentiality, privacy and incident response on CPA ISC
This topic covers the regulations, standards and frameworks in Area II (NIST CSF, COBIT, COSO, HIPAA, GDPR, PCI DSS, ISO 27001), confidentiality and privacy concepts, and incident response.
- Blueprint groups
- II.A, II.C, II.D
- Share of the section
- Area II, Security, Confidentiality and Privacy: 35–45%
- Our drill
- 10 questions from 18 on this topic, untimed, with a reason for every option; one free attempt, unlimited with a pass
What to know
- NIST CSF 2.0 has six functions: Govern, Identify, Protect, Detect, Respond and Recover.
- COBIT 2019 separates governance (Evaluate, Direct and Monitor) from four management domains.
- The GDPR applies to non-EU companies that offer goods or services to people in the EU; breaches are reported to the supervisory authority within 72 hours where feasible.
- PCI DSS is an industry standard for entities that store, process or transmit cardholder data; HIPAA covers covered entities and their business associates.
- Privacy concerns personal information about individuals; confidentiality concerns information designated as confidential.
- Incident response follows preparation; detection and analysis; containment, eradication and recovery; and post-incident activity (NIST SP 800-61 Rev. 2); Rev. 3 (2025) aligns these with the CSF 2.0 functions.
Test yourself on frameworks, confidentiality, privacy and incident response
Ten ISC questions on frameworks, confidentiality, privacy and incident response, untimed, with a reason for every answer option.
Or take the full ISC mock examCommon questions
How much of the ISC section is frameworks, confidentiality, privacy and incident response?
It sits in Blueprint Area II (II.A, II.C, II.D). The AICPA weights whole areas, not single topics; see the area’s range on the ISC page. Our 82-question mock draws each area at the middle of its range.
Are these real ISC questions?
No. The AICPA does not release live exam questions. These are original practice questions written to the published 2027 CPA Exam Blueprints, with a reason for every answer option and the standard or code section behind the key.
More ISC topics
- Information systems, IT general controls and change managementdrill
- Data management, databases and data analyticsdrill
- Security controls and threatsdrill
- Planning and performing SOC engagementsdrill
- SOC reports and opinionsdrill
ISC full mock exam: 4 hours, 5 testletsISC task-based simulations
Blueprint and exam facts checked November 2026: AICPA: Learn what is tested on the CPA Exam (Blueprints effective January 1, 2027) · AICPA: CPA Exam score release and testing windows · NASBA: CPA Exam FAQ · Virginia Board of Accountancy: CPA Exam fees.
Original independent practice questions written to the AICPA CPA Exam Blueprints. Not affiliated with or endorsed by the AICPA or NASBA.