AAISM study scenarios: three manager profiles

How you should study for AAISM depends on whether your security-management experience comes with technical depth, because the largest domain is the technical one. The exam has 90 questions in three domains: AI Technologies and Controls (38%), AI Governance and Program Management (31%) and AI Risk Management (31%). ISACA’s candidate guide gives 150 minutes and a pass mark of 450 on a scaled 200 to 800 range. Every candidate must hold an active CISM or CISSP, so the profiles differ by which of those two they carry and what the day job looks like.

Example profiles, not real people. The profiles below are illustrative planning examples built from the official exam outline. They are not reviews or reports of anyone’s result.

The CISM holder who owns a security programme

Starting point. This profile builds policy, runs risk assessments and answers for incidents. ISACA’s question style, written from the accountable manager’s seat, is already familiar. Technical content has always been delegated.

Where the time goes. AI Technologies and Controls (38%): architecture and where controls sit around a model, the lifecycle with its security decision at each step, data management controls, privacy controls including what outputs can leak, trust and safety controls, and monitoring. Governance (31%) and risk (31%) are extensions of existing method, with new sources of risk such as poisoning, extraction, inversion, evasion and prompt injection.

The trap. Trusting familiarity with the management side. The exam asks which control addresses which weakness, and a manager who has not studied model architecture picks the answer that sounds like a policy.

Suggested order. The site’s study plan: governance in two weeks, risk in one, technologies in two, then practice.

Planning assumption. Six weeks at 6 to 8 hours a week (36 to 48 hours) is a reasonable assumption, with about 12 to 16 hours on technologies and controls. It is a planning figure, not a promise.

The CISSP architect who is deep on controls

Starting point. This profile designs and operates security controls and is comfortable with isolation, logging, trust boundaries and data protection. Building a programme, managing stakeholders and thinking in terms of appetite and treatment are less central.

Where the time goes. Reversed from the previous profile: governance and programme management (31%) is the unfamiliar domain, namely stakeholder considerations, frameworks and regulatory requirements, AI strategy and policy, AI asset and data lifecycle management, programme development, and continuity and incident response. Risk management (31%) needs method rather than technology.

The trap. Answering as the engineer. ISACA questions are written from the accountable manager’s perspective, so the best answer is usually a decision, an assessment or an escalation rather than a configuration, and “FIRST” questions often depend on a step that was skipped.

Suggested order. Governance first, then risk, then a compressed technologies pass, with question practice from week one.

Planning assumption. Six weeks at 6 to 8 hours a week is a reasonable assumption, shifting hours from the technologies weeks to governance and risk.

The security manager whose AI arrives through vendors

Starting point. This profile holds CISM or CISSP in an organisation that uses AI only through third-party products: copilots, hosted model APIs and embedded features. It has no models of its own to train, so attention goes to contracts and due diligence.

Where the time goes. Vendor and supply chain management sits in risk management (31%) and is the strong suit. The gap is the content of domain 3 as if the organisation built things itself, because the exam asks about architecture, lifecycle and data controls generally. Governance topics such as inventories and incident response for hosted models also need care, since containment and rollback differ when a provider can change behaviour silently.

The trap. Narrowing the syllabus to what the organisation does. The exam does not ask which products you use, and a profile that studies only third-party risk leaves the 38% technical domain thin.

Suggested order. Risk first as the confident base, then technologies and controls, then governance, then practice sorted by question type.

Planning assumption. Six weeks at 6 to 8 hours a week is a reasonable assumption, with the technologies weeks protected from cuts.

The three AAISM profiles compared

How to check which AAISM profile fits before booking

Start with the prerequisites, since an active CISM or CISSP is mandatory, and read the exam format page for fees and the five-year application window. Run the sample questions and a full practice test, then sort misses by domain and by qualifier. If one domain trails by a clear margin, move hours there from the 6-week study plan. If you hold CISM and wonder what is new, AAISM vs CISM shows the delta, and the AAIR hub covers the risk-focused credential.