AAISM
AAISM: Advanced in AI Security Management
Everything you need for ISACA AAISM: exam format, the three domains and weights, the CISM or CISSP prerequisite, a study plan and free sample questions.
- Questions
- 90
- Domains
- 3
- Requires
- CISM or CISSP
- Exam fee
- $459 member
AAISM — ISACA Advanced in AI Security Management — is a credential for experienced security managers who are now accountable for AI systems. ISACA positions it as the first AI-centric security management certification, and it is aimed at people who already run a security function rather than people entering one.
The gate is explicit: candidates must hold an active CISM or CISSP certification. This is not a recommendation like most exams give. Without one of those two, you cannot certify.
That prerequisite tells you what kind of exam it is. AAISM assumes you already know security management — governance, risk, programme building, incident response — and tests whether you can apply it to AI systems, their data, their supply chain and their failure modes.
What the exam covers
| Domain | Weight |
|---|---|
| AI Governance and Program Management | 31% |
| AI Risk Management | 31% |
| AI Technologies and Controls | 38% |
Ninety questions across three domains. The weighting is close to even, with the technical domain slightly ahead — which surprises people who expect a management credential to be mostly policy. AI Technologies and Controls is the largest single domain, and it covers architecture, the model lifecycle, data controls and monitoring.
Where to start
Check the prerequisites first, because the CISM or CISSP requirement is absolute. Then the exam format, and how AAISM differs from CISM if you hold the latter and are wondering what is actually new. If you would rather learn the material step by step, the free written course covers all three domains in 13 lessons with diagrams.
AAISM guides
- AAISM free course: AI Security ManagementA free written AAISM course in 13 lessons with diagrams: AI governance, AI risk management and AI security controls, in the order of the ISACA outline.
- AAISM exam format: questions, score and costThe ISACA AAISM format: 90 questions across three domains, fees for members and non-members, the CISM or CISSP gate and the five-year application window.
- AAISM vs CISM: how they differCISM is a prerequisite for AAISM, not an alternative. What AAISM adds, what carries over, and how much new study a CISM holder actually needs.
- AAISM study plan: pass in 6 weeksA six-week AAISM study plan weighted by the three ISACA domains, with extra time for the technologies domain that CISM holders underestimate.
- AAISM sample questions: 5 worked examplesFive worked ISACA AAISM sample questions across the three domains, written in ISACA's BEST and FIRST style, each with an explained answer.
- AAISM AI governance and program managementThe AAISM governance domain explained: stakeholders, frameworks, AI policy, asset and data lifecycle, programme building and incident response.
- AAISM AI risk management explainedThe AAISM risk domain explained: AI risk assessment and thresholds, treatment, threat and vulnerability management, and AI vendor and supply chain risk.
- AAISM AI technologies and controlsThe largest AAISM domain explained: AI security architecture, the model lifecycle, data management controls, privacy and safety controls, and monitoring.
- AAISM prerequisites: CISM or CISSP requiredAAISM has a hard prerequisite: an active CISM or CISSP. What else ISACA expects, what it costs, and what to do if you hold neither.
- Is AAISM hard? Exam difficulty explainedHow hard ISACA AAISM really is: why the prerequisite raises the baseline, why the technologies domain surprises managers, and what catches people out.
- Is AAISM worth it? Who should take itIs ISACA AAISM worth taking? Who benefits, what it costs including the CISM or CISSP requirement, and when another AI security credential fits better.
- Free AAISM practice questions: 20 with answers20 free ISACA AAISM practice questions on AI governance, AI risk management and AI security controls, with explained answers.
- AAISM study resourcesPreparing for ISACA's AI security management certificate: official material, free security frameworks, and what it assumes.
- AAISM cheat sheetA one-page ISACA AAISM reference: domain weights, AI attacks and the controls a security manager can evidence.
- AAISM career: CISO path and next stepsWhere ISACA AAISM fits for security managers: titles it supports, what it does not prove, how it sits on CISM or CISSP, and what to add after.
- AAISM renewal, validity and retake rulesAAISM maintenance: 10 CPEs a year, 30 over three years, a US$20 member fee, the four-attempt retake limit and what happens if the credential is revoked.
- AAISM study scenarios: three manager profilesPlan ISACA AAISM study by background: a CISM programme owner, a CISSP architect and a security manager whose AI comes from vendors.