ISACA's Advanced in AI Security Management (AAISM™) is one of the newest credentials to come out of the security field's scramble to keep pace with AI. If you already hold CISM or CISSP and your role touches AI governance, risk, or controls, it's worth understanding exactly what the exam covers before you commit to a study plan. This guide breaks down the domains, prerequisites, and a realistic path to being ready — written by someone who took and passed it.
What Is the AAISM Certification?
AAISM is ISACA's advanced credential for experienced security professionals who need to manage AI-specific risk inside an organization — identifying where AI systems introduce new threats, building governance and policy around AI use, and applying controls that keep deployments secure. It sits alongside CISM and CISSP rather than replacing either: it's an advanced, specialized layer on top of a credential you're expected to already hold.
It's aimed at people already operating in security management, risk, or advisory roles who are being asked — formally or informally — to weigh in on how their organization uses AI safely.
Prerequisites & Eligibility
AAISM has a firm prerequisite: you need an active CISM or CISSP certification to register. There's no substitute path around this requirement.
Once you register and pay the exam fee, you have a six-month eligibility window to sit the exam — the clock starts on your registration date, not your payment date, so it's worth registering only once you're within striking distance of being ready. Exam appointments can only be booked up to 90 days out, and you can reschedule anytime up to 48 hours before your slot without penalty.
Pricing, as of this writing: $459 for ISACA members and $599 for non-members to sit the exam, plus a separate $50 application fee once you've passed and are ready to apply for the credential itself. Verify current pricing on ISACA's site before registering, since certification fees do shift over time.
Exam Domains & Weighting
The exam is split across three domains. Domain weighting tells you where to spend your study hours — a domain worth over a third of the exam deserves more than a third of your prep time.
| Domain | Weight | Focus areas |
|---|---|---|
| 1 — AI Governance & Program Management | 31% | AI governance structures, stakeholder management, AI strategy & policy, acceptable use, incident response, business continuity |
| 2 — AI Risk Management | 31% | Risk identification, NIST AI RMF, EU AI Act, threat modeling, OWASP LLM Top 10, vendor risk management |
| 3 — AI Technologies & Controls | 38% | AI system architecture, technical security controls, model and data protection |
Domain 3 carries the single largest share of the exam, but Domains 1 and 2 combined make up nearly two-thirds of it — governance and risk framing matters just as much as the technical control knowledge, and it's the area technically-minded candidates most often underprepare for.
How to Study for AAISM: A Suggested Plan
Most candidates who already hold CISM or CISSP and have some hands-on exposure to AI projects spend around two to three months preparing. If you're newer to AI concepts specifically, budget more time — this isn't an exam you can cram for, since it leans heavily on scenario-based questions that test judgment rather than recall.
A workable structure:
- Weeks 1–3 — Domain 1 & 2 foundations. Work through AI governance structures and risk frameworks first. If governance and risk management are already familiar territory from CISM, this moves faster than you'd expect — you're mostly relearning familiar concepts through an AI lens.
- Weeks 4–6 — Domain 3 technical depth. This is where most study time should concentrate, given the 38% weighting. Focus on how AI system architecture creates new attack surfaces and what controls actually mitigate them.
- Weeks 7–8 — Practice questions across all domains. Scenario-based practice is more valuable than flashcard-style review at this stage — you're training judgment, not just recall.
- Final week — Weak-area review and a full timed practice run. Simulate exam conditions once before test day so pacing isn't a surprise.
ISACA's own resources are a reasonable starting point: the official Review Manual, the Questions, Answers & Explanations database, and the member-exclusive ISACA Engage study forum, where candidates trade study tips and get help from experts for free. Treat third-party tools — practice-question apps, study guides like this one — as supplements that reinforce and test what you've learned, not replacements for understanding the underlying concepts.
Want a structured way to drill all three domains? The AAISM™ Study App has 300 practice questions, a full study guide, a glossary, and a 90-question simulated exam — built to work fully offline once unlocked.
Explore the AAISM™ Study App — $14.99Common Mistakes That Trip Up Candidates
A pattern shows up again and again with AAISM candidates: strong technical security backgrounds lead people to over-invest in Domain 3's technical controls while under-preparing for Domains 1 and 2 — governance structures, stakeholder alignment, and the ethical and policy dimensions of AI deployment. Since those two domains combine for 62% of the exam, that imbalance costs more than it seems like it should going in.
The second common trap is treating this like a pure knowledge-recall exam. AAISM questions tend to be scenario-based — describing a situation and asking what the right governance or risk response is — which means memorizing definitions alone won't carry you through. Grounding each concept in a real example (a specific AI incident, a specific control failure) makes that judgment easier to apply under exam conditions.
Frequently Asked Questions
Is the AAISM certification worth it?
For CISM or CISSP holders already working in security, risk, or governance roles that touch AI systems, AAISM adds a focused credential in a fast-growing niche with relatively few certified professionals so far. Whether it's worth it for you depends on whether your current or target role involves AI governance, risk, or security decisions.
How hard is the AAISM exam?
It's scenario-heavy rather than pure memorization — you're tested on whether you can apply governance, risk, and control concepts to realistic situations. Candidates with hands-on AI governance or risk experience tend to find it more manageable than those approaching it purely from a technical AI background.
Can I take the AAISM exam without CISM or CISSP?
No — an active CISM or CISSP certification is a hard prerequisite for AAISM eligibility. There's no alternate path around it.
How long should I study for AAISM?
Most candidates who already hold CISM or CISSP and have some AI project experience spend around two to three months preparing. Those newer to AI concepts should plan for longer, since the exam tests applied judgment more than definitions.