What is the AAISM certification?
Vishwen Labs
AAISM is Advanced in AI Security Management, ISACA's certification for security managers who are responsible for AI systems. It sits on top of an active CISM or CISSP, tests three domains over 90 questions, and is scored on ISACA's 200 to 800 scale with 450 as the pass mark.
Who the AAISM certification is for
ISACA describes AAISM as the first AI-centric security management certification, and the audience is narrow by design. It is for people who already hold CISM or CISSP, have worked in security or advisory roles, and have some experience assessing, implementing or maintaining AI systems. That last part matters: the exam assumes you have seen a model go into production, or at least sat in the meetings where one did.
The typical candidate is a security manager, a CISO's deputy, a GRC lead or a consultant whose clients have started asking what to do about the models their teams are building. The certification says you can run an AI security programme, not that you can train a model.
What the AAISM exam covers
Three domains, weighted the way ISACA's exam content outline sets out. AI Governance and Program Management is 31% of the exam and covers stakeholders, frameworks, regulation, policy, the AI asset and data life cycle, programme management, and continuity and incident response. AI Risk Management is another 31%: risk assessment and thresholds, threat and vulnerability management, and vendors and the supply chain. AI Technologies and Controls is the largest at 38%, with architecture, the model life cycle, data controls, privacy and safety controls, and security monitoring.
Those thirteen topics carry codes from 1A to 3E in the outline. Study material that ignores the codes tends to drift toward whatever the author finds interesting; the outline is what the questions are written against.
How AAISM differs from CISM
CISM certifies that you can run an information security programme. AAISM takes that as given and asks what changes when the assets are models, training data and pipelines rather than servers and databases. Fine-tuning, prompt injection, model theft, data poisoning, vendor models you cannot inspect, and regulation written specifically for AI all appear here and not in CISM.
The exam style is the same family. Scenario questions, four plausible answers, one best. If you passed CISM you will recognise the shape immediately, and you will also recognise the trap, which is answering as an engineer when the question wants a manager.
What the AAISM certification costs and how long you have
The exam is US$459 for ISACA members and US$599 for non-members, taken at a PSI testing centre or remotely proctored. After passing you have five years to apply for the certification itself. Third-party sources report a one-off application fee and an annual maintenance fee with a continuing-education requirement, in line with ISACA's other credentials.
Study material ranges from ISACA's own review manual and question database to courses and apps. AAISM Exam Prep is free to start: the diagnostic, a full chapter and a 25-question mini mock, then a subscription for the full 2,026 questions and four mocks.
Whether AAISM is worth taking
It is a new credential, launched in 2025, so nobody can point to a decade of salary data. What can be said is narrower and more useful. If your job already involves deciding how AI systems are secured, governed or bought, AAISM is the one certification written for exactly that seat, and studying for it forces a structured pass over topics most managers have picked up piecemeal. If your work is hands-on model security, a technical credential may serve you better, and if you do not hold CISM or CISSP the question does not arise yet.
AAISM™ and CISM® are trademarks of ISACA. This app is an independent study aid and is not affiliated with, endorsed by, or sponsored by ISACA.
Questions people also ask
Is AAISM a standalone certification?
No. It requires an active CISM or CISSP to sit the exam, so it functions as an advanced credential on top of one of those. Holding it says you can manage AI security in an organisation that already trusts you with security management.
How long is the AAISM certification valid?
Like ISACA's other credentials it is maintained rather than re-sat: third-party sources report an annual maintenance fee and a continuing-education requirement of ten hours a year. Separately, ISACA gives you five years from passing the exam to apply for the certification.
