ISACA AAISM Study Plan¶

Four weeks at 6-8 hours a week for someone who already holds CISM or CISSP. Study against the current outline.

Week 1: Governance and program management (Domain 1, 31%)¶

• Read notes/01-ai-governance-and-program-management.md
• Skim the NIST AI RMF GOVERN function and the AI Act's Article 5 and Annex III headings
• Draft a one-page AI inventory template for your own organization

Week 2: Risk and opportunity management (Domain 2, 31%)¶

• Read notes/02-ai-risk-and-opportunity-management.md
• Read the NIST AI 100-2 attack-goal summary and the OWASP LLM Top 10 list
• List the questions you would put in an AI vendor assessment

Week 3: Technologies and controls (Domain 3, 38%)¶

• Read notes/03-ai-technologies-and-controls.md
• Read NIST AI 600-1 Sections 2.4, 2.9 and 2.12
• Sketch an AI security architecture with model, data, retrieval and tool layers

Week 4: Practice and review¶

• Work through the practice questions; read every explanation
• Re-read the notes for any domain below 70%
• Work through the scenarios

Readiness check¶

You are ready when you can explain, without notes, the difference between: evasion and poisoning, prompt injection and jailbreaking, a model card and a data lineage record, governance and management, and risk appetite and risk threshold.