AAISM cheat sheet
Last-minute reference for AAISM. The technical domain is the largest, but the reasoning stays managerial: which control removes the mechanism, and how you would evidence it operates.
Exam facts
| Questions | 90 |
| Domains | 3 |
| Requires | CISM or CISSP |
| Exam fee | 459 USD member / 599 USD non-member, plus application fee |
Domain weights
| Domain | Weight |
|---|---|
| AI Technologies and Controls | 38% |
| AI Governance and Program Management | 31% |
| AI Risk Management | 31% |
The five control principles
Internalise these and most of the technical domain answers itself.
- Remove the mechanism, do not merely detect it. Isolate retrieved content from the instruction channel; do not filter for suspicious keywords.
- Enforce at the right layer. Tenant scoping belongs at retrieval and authorisation, before content reaches the model.
- Constrain capability, not just behaviour. Least-privilege tool scoping caps what any manipulation achieves.
- Keep secrets out of reach entirely, rather than instructing the model to withhold them.
- Log for investigation without creating a new target. Metadata and references, sensitive content redacted.
Threat to assessment driver
| Threat | What determines the risk |
|---|---|
| Model extraction | Commercial value, achievable query volume, output richness |
| Indirect prompt injection | Whether untrusted content enters the model’s context |
| Agent misuse | The breadth of the agent’s tool permissions |
| Insider model theft | Access to artefacts and egress controls |
Governance essentials
- Inventory first — owner, data used, risk rating
- Report into existing security governance with executive escalation, not a side working group
- Risk-tier requirements so low-risk systems have a light path, or shadow deployment follows
- Residual risk is documented and formally accepted at the right authority, never approved informally
- KPI that matters: inventory coverage assessed, and time to close findings
Traps
- Output-only filtering leaves malicious input reaching the model and driving actions.
- Vendor refusing to disclose training data is a risk to document and escalate, not to accept silently or reject automatically.
- Non-determinism is what makes AI risk assessment different from application risk assessment.
- Endpoint filtering protects use, not weights. Insider exfiltration needs artefact access control.
Night-before checklist
- Three domains; technologies and controls is 38%
- The five control principles, cold
- Inventory as the foundation of everything
- Check ID and proctoring rules — see exam day
Take the 20-question practice test.