Build Your Personalized ISC Study Plan
Five quick questions. We'll build a ISC plan from the 2026 AICPA Blueprint: weighted topic priorities, a schedule for your timeline, and strategies for where you're stuck.
Where you are
Where are you in your ISC preparation?
What ISC actually tests (2026 AICPA Blueprint)
Plan for roughly 80 hours of focused study for ISC (most candidates land between 60 and 100). The personalized plan above tailors this to your stage, timeline, and biggest challenge. Here is the blueprint it is built on.
ISC content areas and weights
Area I: Information Systems & Data Management
35-45% · ≈ 32 hrsIT infrastructure (hardware, networks, software, and cloud); enterprise and accounting information systems and the business processes they enable; controls over data integrity and system availability, and IT change management; data management — extraction, storage, SQL queries, and integrating data from different sources; business process and data-flow models.
Area II: Security, Confidentiality & Privacy
35-45% · ≈ 32 hrsInformation security, including logical and physical access controls; confidentiality and privacy practices and the regulations that govern them; threat and vulnerability management; detecting and responding to security incidents; testing and remediating controls.
Area III: Considerations for SOC Engagements
15-25% · ≈ 16 hrsSOC 1 versus SOC 2 versus SOC 3 engagements; planning, performing, and reporting on SOC engagements; the types of reports and opinions; complementary user-entity controls and the role of subservice organizations.
ISC is the least like the other sections: it is built around information technology, security, and controls rather than financial accounting. If you come from an accounting background, budget extra time for the IT and security vocabulary, which is where most of the unfamiliarity lives. The SOC area builds on the control concepts from the first two areas, so study it last.
ISC study plan FAQ
How many hours should I study for ISC?
Plan for roughly 80 hours of focused study for ISC. Most candidates spend between 60 and 100 hours, depending on their background, how consistently they study, and their timeline.
Which areas are most heavily weighted on the ISC CPA exam?
Under the 2026 AICPA Blueprint, ISC covers 3 weighted areas: Area I: Information Systems & Data Management (35-45%); Area II: Security, Confidentiality & Privacy (35-45%); Area III: Considerations for SOC Engagements (15-25%). Allocate your study time to match these weights, because that is where the exam awards its points.
What should I know about ISC under the 2026 Blueprint?
ISC is the least like the other sections: it is built around information technology, security, and controls rather than financial accounting. If you come from an accounting background, budget extra time for the IT and security vocabulary, which is where most of the unfamiliarity lives. The SOC area builds on the control concepts from the first two areas, so study it last.