Rule Atlas
SOC 2: ISC-II: Mastering Security, Privacy, and Global Compliance Frameworks
Under SOC 2 (AICPA / FASB / IRS), iSC-II: Mastering Security, Privacy, and Global Compliance Frameworks establishes the authoritative rules tested on the CPA Exam. A comprehensive guide to information security (CIA Triad, Defense in Depth), the five SOC 2 Trust Services Criteria, and data privacy frameworks like GDPR and CPRA. VoraPrep verifies every threshold, worked table, and practice question below against the current CPA Exam blueprint.
The Five Pillars of Trust: SOC 2 Trust Services Criteria
| Trust Service Criterion | Core Question | Example Controls to Test |
|---|---|---|
| Security (Required) | Are systems and data protected against unauthorized access and disclosure? | Firewall configurations, intrusion detection, multi-factor authentication, vulnerability management. |
| Availability | Is the system available for operation and use as committed? | Performance monitoring, disaster recovery testing, backup and restoration procedures. |
| Processing Integrity | Is system processing complete, valid, accurate, timely, and authorized? | Input validation checks, data reconciliation procedures, quality assurance (QA) testing. |
| Confidentiality | Is information designated as confidential protected as committed? | Encryption, access control lists (ACLs), data loss prevention (DLP) tools. |
| Privacy | Is personal information handled in conformity with the entity’s privacy notice? | Privacy policy disclosures, consent management, data subject access request (DSAR) procedures. |
A CPA firm's server room HVAC system has malfunctioned, causing temperatures to consistently exceed safe operating limits (85°F-95°F) for 72 hours. Which of the following actions should the firm prioritize FIRST to mitigate immediate risks to data and hardware?
Applied Scenario: A CPA's Role in a Privacy Audit
Scenario: You are an ISC specialist at a CPA firm engaged to perform a SOC 2 Type 2 examination for CloudCo, a SaaS provider. The scope includes the Security, Availability, and Privacy Trust Services Criteria. CloudCo has customers in both California and Germany.
- Objective: Assess whether CloudCo's controls are suitably designed and operating effectively to meet its security, availability, and privacy commitments.
- 1. Scoping: You confirm that GDPR (due to German customers) and CPRA (due to California operations) are in scope for the Privacy TSC. The audit must test controls relevant to both.
- 2. Testing Notice and Consent (Privacy TSC): You review CloudCo's privacy policy for clear disclosures (Purpose Limitation). For German users, you test the cookie banner to ensure it requires an affirmative, opt-in action to comply with GDPR.
- 3. Testing Data Subject Access Requests (DSARs) (Privacy TSC): You inspect the system for handling user requests. You trace a sample request from a German user for data erasure and one from a Californian user to opt-out of data sharing, verifying completion within statutory timeframes (30 days for GDPR, 45 for CPRA).
Common CPA Exam Distractors on SOC 2
- 1When faced with an ISC scenario question on security or privacy, use this five-step framework to deconstruct the problem and find the correct answer.
- 2Step 1. Identify the Core Domain. Is the question primarily about protecting systems from threats (Security), handling personal data correctly (Privacy), or adhering to a specific law (Compliance)? This initial sort is crucial.
- 3Step 2. Pinpoint the Guiding Principle or Framework. If it's a security question, think CIA Triad or Defense in Depth. If it's a service organization's controls, think SOC 2 Trust Services Criteria. If it's a privacy issue, think Data Privacy Principles.
- 4Step 3. Determine the Jurisdiction. Read the facts carefully. Does the scenario involve individuals in the EU? Trigger GDPR. California residents? Trigger CPRA. This determines the specific rules that apply.
- 5Step 5. Evaluate the Control or Violation. Based on your mapping, determine if a control is effective or if a principle has been violated. Eliminate distractors that confuse security with privacy or apply the wrong legal framework.
Frequently Asked Questions: SOC 2
What is the core rule under SOC 2 (ISC-II: Mastering Security, Privacy, and Global Compliance Frameworks)?
Under SOC 2 (AICPA / FASB / IRS), iSC-II: Mastering Security, Privacy, and Global Compliance Frameworks establishes the authoritative rules tested on the CPA Exam. A comprehensive guide to information security (CIA Triad, Defense in Depth), the five SOC 2 Trust Services Criteria, and data privacy frameworks like GDPR and CPRA. VoraPrep verifies every threshold, worked table, and practice question below against the current CPA Exam blueprint.
How is SOC 2 tested on the CPA Exam?
When faced with an ISC scenario question on security or privacy, use this five-step framework to deconstruct the problem and find the correct answer. Step 1. Identify the Core Domain. Is the question primarily about protecting systems from threats (Security), handling personal data correctly (Privacy), or adhering to a specific law (Compliance)? This initial sort is crucial.
Where can I practice CPA Exam questions on ISC-II: Mastering Security, Privacy, and Global Compliance Frameworks?
Test yourself instantly with the free playable CPA Exam question on this page, or launch VoraPrep's full CPA Exam adaptive question bank, interactive lessons, and 1:1 exam simulator at voraprep.com/cpa.