Is AAISM worth it? Who should take it

AAISM is worth it if you are already a certified security manager and AI has landed in your remit. It is ISACA’s AI-centric security management credential, it sits on top of CISM or CISSP rather than competing with them, and it addresses a set of questions — who owns AI risk, what does due diligence on a model provider look like, what does an AI incident response plan contain — that most organisations are currently improvising.

It is not worth it if you do not already hold CISM or CISSP, because you cannot certify without one.

Who gets the most out of it

CISM or CISSP holders whose organisations are deploying AI. The core audience. You have the methodology; what you lack is the AI-specific content, and this is a structured way to acquire it. If you have recently been asked “is this AI system safe to deploy” and had to improvise the answer, that is the signal.

Security managers in regulated industries. Financial services, healthcare, public sector. The governance domain — inventories, impact assessments, human oversight, documentation, auditability — maps directly onto what regulators are beginning to ask for.

Consultants and advisors. ISACA credentials carry weight in audit and advisory contexts, and being early in a scarce specialism is worth more now than it will be later.

Anyone who will be accountable when an AI system fails. That accountability is being assigned right now, often to people who did not ask for it. This syllabus is a reasonable description of what the role requires.

Who should skip it

• Anyone without CISM or CISSP. Not a judgement — a hard eligibility rule. See the prerequisites for alternatives.
• Hands-on engineers. This is a management credential. If you want to implement AI security controls, CompTIA SecAI+ or a cloud-specific certification like SC-500 will serve you better.
• Anyone unwilling to maintain two credentials. Your CISM or CISSP must remain active, so you carry both sets of continuing education indefinitely.
• People wanting broad recognition today. AAISM is new. Hiring managers outside ISACA’s orbit may not know it yet.

What it costs

The honest total is higher than the headline. If you do not already hold the prerequisite, the real cost of AAISM includes earning and maintaining CISM or CISSP first — months of work and a recurring obligation, not a US$459 exam.

Pricing ISACA membership is worth doing: the US$140 exam saving covers a meaningful share of it, especially alongside CISM maintenance.

The honest case against

It is new, and recognition lags content. The material is current and useful; the name is not yet on job adverts. Its value today is in what it teaches and what it signals to people who already know ISACA, not in keyword matching.

The field is unsettled. AI security management practice is still forming. Some specifics will shift. What lasts is the structure — treating models and data as assets, identifying which lifecycle stage a threat targets, running due diligence on model providers.

The prerequisite narrows it sharply. A credential you can only hold by holding another credential will always have a small population. That is good for scarcity and bad for recognition.

Two renewal cycles. Permanent overhead.

The verdict

For a CISM or CISSP holder already dealing with AI at work, AAISM is a sound investment: four to six weeks, a credential few people hold, and content that maps onto work arriving now. The governance and supply chain material in particular is immediately useful whether or not you sit the exam.

For everyone else, the prerequisite decides it. If you do not hold CISM or CISSP, your route is to earn one of those first — or to pick up a credential without an eligibility gate, in which case start with CompTIA SecAI+.

Check the prerequisites properly before committing, and try the free sample questions to see whether ISACA’s question style suits you.