Rule Atlas
SOC 2: Cybersecurity Defense: A Layered Approach from Controls to Compliance
Under SOC 2 (AICPA / FASB / IRS), cybersecurity Defense: A Layered Approach from Controls to Compliance establishes the authoritative rules tested on the CPA Exam. Master the integrated framework of cybersecurity for the ISC exam. VoraPrep verifies every threshold, worked table, and practice question below against the current CPA Exam blueprint.
Layer 1: Implementing Robust Security Controls
| Control Type | Purpose | Example(s) |
|---|---|---|
| Preventative | To stop an incident from occurring. | Firewalls, access control lists (ACLs), user authentication (passwords, MFA), data encryption. |
| Detective | To identify that an incident has occurred. | Intrusion Detection Systems (IDS), security camera footage, system logs, periodic account reviews. |
| Corrective | To limit the extent of damage and recover. | Restoring data from backups, activating a disaster recovery plan, patching a vulnerability after an attack. |
Following several security breaches, Omega Corp is re-evaluating its security strategy. The Chief Information Security Officer (CISO) advocates for adopting the principle of "defense in depth." Which of the following best describes this principle?
Example: Walking Through a Phishing Attack
Scenario: An accounts payable clerk at Veridian Corp receives an email that appears to be from a legitimate vendor with an attached invoice. The clerk opens the attachment, which executes malware that begins encrypting files on their workstation and connected network drives.
- Applying the Incident Response Lifecycle:
- 1. Preparation: Veridian Corp already has an IR plan, a trained response team, and has deployed an Endpoint Detection and Response (EDR) tool on all workstations. This is the most critical phase and happens before any incident.
- 2. Identification: The EDR tool detects the anomalous file encryption behavior and sends an alert to the security team. The team confirms the activity is malicious and declares an official incident.
- 3. Containment: The immediate priority is to stop the bleeding. The security team remotely isolates the clerk's workstation from the network to prevent the malware from spreading further.
Common CPA Exam Distractors on SOC 2
- 1To remember the six phases of the incident response lifecycle, use the mnemonic PICERL:
- 2Preparation: Building the tools, team, and plan before an incident.
- 3Identification: Confirming a breach has occurred and assessing its scope.
- 4Containment: Isolating affected systems to prevent further damage.
- 5Eradication: Removing the threat completely from the environment.
Frequently Asked Questions: SOC 2
What is the core rule under SOC 2 (Cybersecurity Defense: A Layered Approach from Controls to Compliance)?
Under SOC 2 (AICPA / FASB / IRS), cybersecurity Defense: A Layered Approach from Controls to Compliance establishes the authoritative rules tested on the CPA Exam. Master the integrated framework of cybersecurity for the ISC exam. VoraPrep verifies every threshold, worked table, and practice question below against the current CPA Exam blueprint.
How is SOC 2 tested on the CPA Exam?
To remember the six phases of the incident response lifecycle, use the mnemonic PICERL: Preparation: Building the tools, team, and plan before an incident.
Where can I practice CPA Exam questions on Cybersecurity Defense: A Layered Approach from Controls to Compliance?
Test yourself instantly with the free playable CPA Exam question on this page, or launch VoraPrep's full CPA Exam adaptive question bank, interactive lessons, and 1:1 exam simulator at voraprep.com/cpa.