AAISM
AAISM: Advanced in AI Security Management
Everything you need for ISACA AAISM: exam format, the three domains and weights, the CISM or CISSP prerequisite, a study plan and free sample questions.
- Questions
- 90
- Domains
- 3
- Requires
- CISM or CISSP
- Exam fee
- $459 member
AAISM — ISACA Advanced in AI Security Management — is a credential for experienced security managers who are now accountable for AI systems. ISACA positions it as the first AI-centric security management certification, and it is aimed at people who already run a security function rather than people entering one.
The gate is explicit: candidates must hold an active CISM or CISSP certification. This is not a recommendation like most exams give. Without one of those two, you cannot certify.
That prerequisite tells you what kind of exam it is. AAISM assumes you already know security management — governance, risk, programme building, incident response — and tests whether you can apply it to AI systems, their data, their supply chain and their failure modes.
What the exam covers
| Domain | Weight |
|---|---|
| AI Governance and Program Management | 31% |
| AI Risk Management | 31% |
| AI Technologies and Controls | 38% |
Ninety questions across three domains. The weighting is close to even, with the technical domain slightly ahead — which surprises people who expect a management credential to be mostly policy. AI Technologies and Controls is the largest single domain, and it covers architecture, the model lifecycle, data controls and monitoring.
Where to start
Check the prerequisites first, because the CISM or CISSP requirement is absolute. Then the exam format, and how AAISM differs from CISM if you hold the latter and are wondering what is actually new.
AAISM guides
- AAISM exam format: questions, score and costThe ISACA AAISM format: 90 questions across three domains, fees for members and non-members, the CISM or CISSP gate and the five-year application window.
- AAISM vs CISM: how they differCISM is a prerequisite for AAISM, not an alternative. What AAISM adds, what carries over, and how much new study a CISM holder actually needs.
- AAISM study plan: pass in 6 weeksA six-week AAISM study plan weighted by the three ISACA domains, with extra time for the technologies domain that CISM holders underestimate.
- Free AAISM sample questions with answersFive free ISACA AAISM practice questions across the three domains, written in ISACA's BEST and FIRST style, each with an explained answer.
- AAISM AI governance and program managementThe AAISM governance domain explained: stakeholders, frameworks, AI policy, asset and data lifecycle, programme building and incident response.
- AAISM AI risk management explainedThe AAISM risk domain explained: AI risk assessment and thresholds, treatment, threat and vulnerability management, and AI vendor and supply chain risk.
- AAISM AI technologies and controlsThe largest AAISM domain explained: AI security architecture, the model lifecycle, data management controls, privacy and safety controls, and monitoring.
- AAISM prerequisites: CISM or CISSP requiredAAISM has a hard prerequisite: an active CISM or CISSP. What else ISACA expects, what it costs, and what to do if you hold neither.
- Is AAISM hard? Exam difficulty explainedHow hard ISACA AAISM really is: why the prerequisite raises the baseline, why the technologies domain surprises managers, and what catches people out.
- Is AAISM worth it? Who should take itIs ISACA AAISM worth taking? Who benefits, what it costs including the CISM or CISSP requirement, and when another AI security credential fits better.