AAISM (ISACA Advanced in AI Security Management) is ISACA’s AI security certification for security managers, and it’s only open to people who hold an active CISM or CISSP. The exam is 90 multiple-choice questions in 2.5 hours, you need 450 on ISACA’s 200 to 800 scale to pass, and it costs $459 for ISACA members or $599 for non-members, plus a $50 application fee once you pass.
This AAISM study guide covers the eligibility rule in detail, ISACA’s three exam domains and 13 subdomains (labeled as ISACA’s published outline), how to study each one, and a five-week plan using ISACA’s official prep resources.
AAISM at a glance
| Credential | ISACA Advanced in AI Security Management (AAISM) |
| Certifying body | ISACA |
| Who can take it | Holders of an active CISM or CISSP |
| Exam fee | $459 for ISACA members, $599 for non-members |
| Application fee | $50, one time, paid when you apply for certification after passing |
| Questions | 90 multiple choice, each with four options and one best answer |
| Time | 2.5 hours (150 minutes) |
| Passing score | 450 on a scale of 200 to 800 |
| Delivery | PSI test center or remote proctoring (remote proctoring isn’t offered in India, Mainland China or Hong Kong) |
| Languages | English, Spanish and Japanese |
| Booking window | Six months from registration; one six-month extension available for $75 |
| Retakes | Up to four attempts in a rolling 12 months, with waits of 30, 90 and 90 days; full fee each time |
| Apply within | Five years of passing the exam |
| Renewal | 10 CPE hours in AI a year and 30 over three years, a $20 (members) or $35 (non-members) annual fee, and proof of an active CISM or CISSP |
| Launched | August 19, 2025 |
Checked against ISACA’s AAISM certification page, AAISM exam content outline, AAISM exam candidate guide and AAISM maintenance page on October 6, 2026.
Can you take the AAISM without a CISM or CISSP?
No. ISACA’s AAISM page says candidates must hold an active CISM or CISSP certification, and its Get AAISM Certified page describes the exam as open to active CISM and CISSP holders. CISSP comes from ISC2, so you don’t need an ISACA credential to qualify; an active CISSP is enough.
To actually be certified, ISACA’s candidate guide lists six steps: hold an active CISM or CISSP, pass the AAISM exam, pay the $50 application processing fee, submit the application, follow ISACA’s Code of Professional Ethics and terms, and follow the AAISM continuing education policy. You have five years from your passing date to apply. The prerequisite also sticks with you: renewing AAISM requires proof that your CISM or CISSP is still active.
If you don’t hold either credential yet, look at our AI security certifications guide, which covers options with no prerequisite, such as CompTIA SecAI+, alongside the AAISM.
Who the AAISM is for
ISACA’s candidate guide describes AAISM as designed for IT security professionals with a CISM or CISSP who want recognition for their expertise in securing enterprise AI solutions and using AI to improve security operations. Its certification page adds proven experience in security or advisory roles and some expertise assessing, implementing and maintaining AI systems.
In other words, this is a management credential, not a hands-on hacking test. ISACA’s outline is written from a security leader’s point of view: governance, risk and controls.
The three AAISM domains at a glance
| Domain (ISACA’s published outline) | Weight | About how many of 90 questions |
|---|---|---|
| 1. AI Governance and Program Management | 31% | 28 |
| 2. AI Risk Management | 31% | 28 |
| 3. AI Technologies and Controls | 38% | 34 |
The question counts are our math on ISACA’s percentages; ISACA says the percentages show the share of the exam each domain represents, and the exam also contains unscored pretest items. Your score is based on the total number of questions you get right, regardless of domain, so you can’t skip one. Note that the candidate guide calls Domain 2 “AI Risk and Opportunity Management” while the outline page says “AI Risk Management”; the subdomains are the same.
ISACA also publishes 22 tasks that the exam is built around. It lists them as one set rather than by domain, so in the sections below we’ve grouped them under the domain where each one fits best. That grouping is ours.
Domain 1: AI Governance and Program Management (31%)
ISACA describes this domain as advising stakeholders on implementing AI security through policy, data governance, program management and incident response.
What the outline lists:
- 1A Stakeholder considerations, industry frameworks and regulatory requirements
- 1B AI-related strategies, policies and procedures
- 1C AI asset and data life cycle management
- 1D AI security program development and management
- 1E Business continuity and incident response
Related tasks from ISACA’s list: collaborate on a charter, roles and responsibilities for AI governance; establish AI-specific security policies and procedures; ensure responsible use of AI using leading practices, ethics, regulation and industry frameworks; identify, inventory and classify AI data and assets; investigate, document and report AI security incidents; run AI incident handling from containment through recovery; cover AI in business continuity and disaster recovery planning; and develop AI security awareness training and acceptable use guidelines.
How to study it: if you hold CISM or CISSP, the governance vocabulary will be familiar. Focus on what changes when the asset is an AI system. Draft an outline of an AI security policy, extend an incident response playbook with AI-specific scenarios, and sketch how you’d inventory AI models, datasets and third-party AI services. ISACA’s outline mentions industry frameworks and regulatory requirements without naming them, so get comfortable with widely used ones such as the NIST AI Risk Management Framework (its four functions are Govern, Map, Measure and Manage) and ISO/IEC 42001 for AI management systems, plus the AI laws that apply where you work. Our guides to an AI acceptable-use policy, building an AI inventory and shadow AI policy show these artifacts in practice.
Domain 2: AI Risk Management (31%)
ISACA describes this domain as assessing and managing the risks, threats, vulnerabilities and supply chain issues that come with enterprise-wide AI adoption.
What the outline lists:
- 2A AI risk assessment, thresholds and treatment
- 2B AI threat and vulnerability management
- 2C AI vendor and supply chain management
Related tasks from ISACA’s list: participate in or oversee the AI risk management life cycle, including its impact on enterprise risk; identify and assess the AI threat landscape; monitor internal and external factors that call for reassessing risk; design and implement testing and vulnerability management for AI solutions; conduct AI impact assessments and ensure regulatory conformity; and embed, monitor and verify security requirements in vendor AI-enabled solutions.
How to study it: practice turning AI risks into risk register entries with an owner, a threshold and a treatment choice (accept, mitigate, transfer or avoid). For the threat landscape, learn the main attack types against AI systems, such as prompt injection, data poisoning and model theft. ISACA doesn’t name a catalog, but public ones like MITRE ATLAS and the OWASP Top 10 for LLM applications are a quick way to build that vocabulary. For 2C, our post on two questions to add to every vendor security review is a good starting point. The candidate guide’s name for this domain includes “opportunity”, so also be ready to weigh where AI reduces risk, such as in security operations.
Domain 3: AI Technologies and Controls (38%)
The largest domain. ISACA describes it as optimizing AI security through knowledge of the security technologies, techniques and controls tailored to AI systems.
What the outline lists:
- 3A AI security architecture and design
- 3B AI life cycle (for example, model selection, training and validation)
- 3C Data management controls
- 3D Privacy, ethical, trust and safety controls
- 3E Security controls and monitoring
Related tasks from ISACA’s list: design and implement security architecture for AI; advise on integrating AI architecture into enterprise architecture; design, implement and regularly review AI security controls; identify and treat security risk in data used across the AI life cycle; define and monitor security metrics for AI; review and implement AI security tools; conduct risk-based human oversight of AI inputs and outputs (trust and safety, quality, explainability and robustness); and advise on security risk and controls in the AI development life cycle.
How to study it: this is the domain where a management background helps least. You won’t be asked to code, but you need to know how an AI system is put together: training data, the model, the inference endpoint, any retrieval data store and any tools an agent can call. Draw a reference architecture for an AI application you know and mark the control at each point: access control, data classification, input and output filtering, logging and monitoring, and human review. Then decide which metrics you’d report to leadership. Our guides to AI security readiness and data readiness for AI cover common control gaps.
How AAISM questions work
ISACA’s candidate guide says every question has a stem and four options with one best answer, and some questions turn on a qualifier such as MOST likely or BEST. Its tips: read each question carefully, eliminate the answers you know are wrong, and answer every question, because there’s no penalty for a wrong answer.
Because the credential targets security managers, the best answer tends to be the one that fits a governance and risk-based approach for the whole organization, rather than the most technical fix. When two options both look right, ask which one a security leader would do first.
A study plan for the AAISM
None of ISACA’s prep products is required; the only eligibility requirement is an active CISM or CISSP. ISACA’s official AAISM resources are:
- AAISM Review Manual, in digital and print versions.
- AAISM Questions, Answers and Explanations (QAE) Database: a six-month subscription to a pool of 200+ practice questions.
- AAISM Online Review Course and an ISACA Virtual Workshop.
- Free AAISM practice quiz: 12 questions from ISACA’s test prep. You fill in a form to see your results.
- Engage AAISM study groups: an online forum for ISACA members.
A five-week plan (about 35 hours): ISACA doesn’t publish recommended study hours, so this pacing is our suggestion for someone who already holds CISM or CISSP. Give Domain 3 extra time if you’ve never worked closely with an AI system.
| Week | Focus | Hours |
|---|---|---|
| 1 | Take ISACA’s free 12-question quiz cold, read the content outline and all 22 tasks, then study Domain 1 | 7 |
| 2 | Domain 2: risk assessment, the AI threat landscape and vendor risk | 7 |
| 3 | Domain 3, part one: AI architecture, the AI life cycle and data management controls (3A to 3C) | 7 |
| 4 | Domain 3, part two: privacy, ethics, trust and safety controls, plus security controls and monitoring (3D and 3E) | 7 |
| 5 | Timed practice with ISACA’s QAE or review manual, then revisit your weakest subdomain | 7 |
Register when you start studying if you like a deadline: you’ll have six months from registration to sit the exam, and appointments open up to 90 days in advance.
Exam day
- You can book an appointment as early as 48 hours after paying, and you can reschedule without penalty up to 48 hours before it.
- One break of up to 10 minutes is allowed with the proctor’s permission, but the timer keeps running. No food or drinks, including water, at a test center or at home.
- Online exams need a room scan and a mirror or phone check of your screen and keyboard before you start.
- You see a preliminary pass or fail on screen. The official score arrives by email within 10 working days, and if you fail you can request a rescore within 30 days for $75.
Keeping the AAISM after you pass
Once certified, report at least 10 CPE hours in AI every year and 30 over each three-year period. ISACA says the hours can also count toward other ISACA certifications when the activity applies to them. The annual maintenance fee is $20 for members or $35 for non-members, due January 1, and one fee covers all of your ISACA Advanced certifications. You also need to keep proving that your CISM or CISSP is active.
Our guide to AI certification renewal rules compares AAISM’s upkeep with other AI credentials, and the free renewal tracker keeps all your CPE dates in one place.
AAISM vs other AI security and governance credentials
| Credential | Prerequisite | Exam fee | Exam | Renewal |
|---|---|---|---|---|
| ISACA AAISM | Active CISM or CISSP | $459 members, $599 non-members, plus $50 application fee | 90 questions, 2.5 hours, 450 of 800 to pass | 10 CPE hours in AI a year, $20 or $35 a year |
| CompTIA SecAI+ (CY0-001) | None required; CompTIA recommends 3 to 4 years in IT with 2+ years hands-on cybersecurity | $298 | Up to 60 questions, 60 minutes, 600 of 900 to pass | Every 3 years: 15 CEUs and a $75 fee |
| ISACA AAIA (AI audit) | Active CISA, or CIA, CPA or similar with an IT audit or advisory focus | $459 members, $599 non-members, plus $50 application fee | 90 questions, 2.5 hours | 10 CPE hours in AI a year |
| IAPP AIGP (AI governance) | None | $649 members, $799 non-members | 100 questions (85 scored), 2 hours 45 minutes | 20 credits every 2 years |
Choose AAISM if you already lead security and hold CISM or CISSP. If you’re earlier in your security career, CompTIA’s SecAI+ is the more hands-on option, with no prerequisite; our SecAI+ review and SecAI+ study plan cover it. If your role leans toward policy and law rather than security controls, compare the AIGP in our AI governance certifications guide. For every AI credential in one place, see the AI certification index or our ranking of the best AI certifications in 2026. Want the full cost including prep and renewals? Try the AI certification cost calculator →
HOW TO // AI is not affiliated with or endorsed by ISACA. AAISM, Advanced in AI Security Management and CISM are marks of ISACA, and CISSP is a mark of ISC2; we reference them descriptively. This guide is original and based on ISACA’s published exam content outline and candidate guide. Check the official AAISM page before you register.
Keep exploring: AIGP study guide · CompTIA SecAI+ study guide
Related guides
- AI Security Certifications in 2026: SecAI+, AAISM, GIAC and More
- AI Governance Certifications in 2026: Every Real Option Compared
- AIGP Study Guide: The IAPP AI Governance Exam, Domain by Domain
- CompTIA SecAI+ Study Guide (CY0-001): All 4 Domains, Weights and a 4-Week Plan
Frequently asked questions
What is the AAISM certification?
AAISM (ISACA Advanced in AI Security Management) is ISACA's certification for security managers who secure enterprise AI and use AI in security operations. It launched in August 2025 and covers AI governance and program management, AI risk management, and AI technologies and controls.
Do I need a CISM or CISSP to take the AAISM?
Yes. ISACA says AAISM candidates must hold an active CISM or CISSP certification, and renewing AAISM requires proof that it is still active. An ISC2 CISSP qualifies on its own, so you don't need an ISACA credential first.
How much does the AAISM exam cost?
The AAISM exam costs $459 for ISACA members and $599 for non-members. After you pass you pay a one-time $50 application processing fee, and each retake costs the full exam fee again.
How many questions are on the AAISM exam?
The AAISM exam has 90 multiple-choice questions in 2.5 hours. Each question has four options and one best answer, and you can take it at a PSI test center or with remote proctoring.
What is the AAISM passing score?
You need a scaled score of 450 on ISACA's scale of 200 to 800. Your score is based on the total number of questions you answer correctly, not on each domain separately.
What are the AAISM exam domains?
ISACA's outline has three: AI Governance and Program Management (31%), AI Risk Management (31%) and AI Technologies and Controls (38%), split into 13 subdomains in total.
How should I study for the AAISM?
Start with ISACA's exam content outline and its free 12-question practice quiz, then work through the three domains, giving AI Technologies and Controls the most time because it is 38% of the exam. ISACA's official prep includes a review manual, a 200+ question practice database, an online review course and a virtual workshop.
How do you maintain the AAISM certification?
Report at least 10 CPE hours in AI each year and 30 over three years, pay the annual maintenance fee of $20 for members or $35 for non-members, and keep your CISM or CISSP active.
