ISACA AAISM - Advanced in AI Security Management¶

The credential for the security manager who is now asked, "is our AI secure?" It assumes you already hold CISM or CISSP and tests whether you can run an AI security program: set governance, assess AI-specific risk, and choose and monitor controls across the AI life cycle. For the AI engineering side see AI safety at ai.noblerworks.com.

Exam Details¶

• Exam Code: AAISM
• Duration: 2.5 hours (150 minutes)
• Questions: 90 multiple-choice
• Passing Score: 450 on a 200-800 scale
• Cost: US$459 member / US$599 nonmember (ISACA, checked 2026-11-07)
• Prerequisites: active CISM or CISSP to be certified
• Content outline: current ISACA outline (publication date not stated on the page, checked 2026-11-07)

Full detail, with sources, in the fact sheet.

Domains¶

How the exam thinks¶

ISACA's guide says questions measure practical knowledge and the application of general concepts and standards, each with one best answer. At this level the best answer is the manager's: align to business objectives, work from risk, document and govern, and choose a control that fits the threat. Technical depth is needed in Domain 3 (38%), but you are asked what to require, check and monitor, not how to code it.

Study sequence¶

1. AI Governance and Program Management (31%) - frameworks, policy, inventory, program, incidents.
2. AI Risk and Opportunity Management (31%) - assessment, threats and vulnerabilities, vendors.
3. AI Technologies and Controls (38%) - architecture, the model life cycle, data, privacy and safety controls, monitoring. Largest weight, so give it the most time.

Schedule in the practice plan.

Study resources¶

• 📖 ISACA AAISM certification page - official entry point
• 📖 AAISM exam content outline - study against this
• Practice questions - original question bank in this repo
• AI safety pillar - the AI-side companion site

After AAISM¶