AAISM course
AAISM free course: AI Security Management
A free written AAISM course in 13 lessons with diagrams: AI governance, AI risk management and AI security controls, in the order of the ISACA outline.
This free written course teaches the AAISM content outline from the ground up, in the order ISACA lists it. Each lesson takes about five to seven minutes to read, builds one idea with a diagram or a worked example, and ends with three check questions. No account is needed. It is independent study material and is not affiliated with or endorsed by ISACA.
ISACA publishes the outline as subtopic headings and task statements, not as detailed content, so the lessons teach each heading with established professional knowledge applied to AI, and use frameworks and regulations as examples a practitioner works with. The three domains map to the lessons like this:
| Lessons | Domain | Weight |
|---|---|---|
| 1 to 5 | AI Governance and Program Management | 31% |
| 6 to 8 | AI Risk Management | 31% |
| 9 to 12 | AI Technologies and Controls | 38% |
| 13 | All three together: how scenario questions are built | – |
How to use the course
Read the lessons in order the first time. The technologies and controls lessons are the largest domain and build on the governance and risk vocabulary: asset inventory, risk thresholds, ownership and policy come back in almost every scenario. After a lesson, answer its check questions before reading the next one.
When the order is clear, use the other guides for what a course cannot do. The exam format page explains the 90 questions and how ISACA questions read. The study plan spreads the work over six weeks. The cheat sheet is the page to reread the day before. The free practice test and sample questions show how scenario questions read.
Lessons
- AI security managementWhy securing AI differs from securing classic IT, how the AAISM outline splits into three domains of 31, 31 and 38 percent, and who shapes the work.
- AI strategy and policyHow an AI security strategy follows business goals, and how acceptable use, policy, standards, guidelines and procedures form a hierarchy with clear roles.
- AI assets and data life cycleHow to inventory, classify, own, protect and retire AI assets such as models, datasets, prompts, agents and endpoints, including the data they depend on.
- The AI security programHow to build and run an AI security program: components, awareness training, metrics, tools, integration with the existing security program and maturity.
- AI incident responseHow AI incidents differ from outages, how to run detect, contain, eradicate, recover and report, and how to keep AI-dependent processes running.
- AI risk assessmentHow to assess AI risk, set thresholds from appetite, choose a treatment, document residual risk and decide when to reassess.
- AI threats and testingLearn the AI attack surface stage by stage, from poisoning to prompt injection, and how red teaming and vulnerability management fit AAISM domain 2.
- AI vendors and supply chainHow to assess and monitor third-party AI: models, APIs, datasets and plugins, with due diligence, contract clauses and concentration risk for AAISM.
- AI security architectureLearn the layers of a secure AI architecture, from gateway guardrails to data and infrastructure, plus zero trust and secure-by-design ideas for AAISM.
- Securing the AI life cycleWalk through secure model selection, training, validation, deployment and maintenance, with the security gate at each stage, for AAISM domain 3.
- Data controls for AIApply classification, minimisation, access control, encryption, provenance, retention and disposal to training, fine-tuning and retrieval data for AAISM.
- Trust controls and monitoringPrivacy, bias, explainability, human oversight and safety guardrails, plus AI logging, detection, metrics and security tools (AAISM 3D and 3E).
- Scenarios across domainsThree worked AAISM scenarios across governance, risk and controls, with a method for reading the role and stage and a situation to first-action table.