AAISM Certifications refer to ISACA’s Advanced in AI Security Management credential for experienced security leaders who already hold an active CISM or CISSP. The certification validates practical ability in AI governance, AI risk management, security architecture, data controls, privacy, ethics, incident response, and supply-chain oversight. Candidates take a 90-question, 150-minute exam and need a scaled score of 450 or higher. The exam costs US$459 for ISACA members and US$599 for non-members, excluding the US$50 application fee after passing the examination.
The ISACA AAISM certification is not an introductory AI course or a machine-learning engineering credential. It is an advanced security-management certification for professionals responsible for deciding how enterprise AI should be governed, secured, monitored, and kept within acceptable risk limits.An AI engineer may focus on training, tuning, or deploying a model. An AAISM professional must address ownership, permitted data use, model-change approval, third-party exposure, control monitoring, incident response, and executive reporting.ISACA designed the credential to build on the security-management practices represented by CISM and CISSP and validate the ability to identify, assess, monitor, and mitigate enterprise AI risk.
Candidates must hold an active CISM or CISSP certification. Passing the exam alone does not remove this requirement, and the qualifying credential must remain active after AAISM is awarded.ISACA also recommends security or advisory experience and some familiarity with assessing, implementing, or maintaining AI systems. The credential therefore fits security managers, architects, consultants, governance leaders, risk professionals, and senior practitioners—not complete cybersecurity beginners.
| Requirement | Current rule |
|---|---|
| Qualifying credential | Active CISM or CISSP |
| Recommended background | Security management or advisory experience |
| AI exposure | Some experience with enterprise AI systems |
| Application deadline | Within five years of passing |
| Ongoing requirement | Keep CISM or CISSP active |
A useful readiness test is whether you can already discuss risk appetite, control ownership, incident response, third-party risk, data governance, and executive accountability. AAISM training should add the AI-specific layer rather than teach security management from zero.
The AAISM certification exam contains 90 multiple-choice questions and lasts 150 minutes. It is available in English, Spanish, and Japanese. ISACA reports scores on a 200–800 scale, with 450 required to pass.Questions use a one-best-answer format and test practical application rather than simple recall.
| Exam detail | Official specification |
|---|---|
| Questions | 90 multiple choice |
| Duration | 150 minutes |
| Passing score | 450 on a 200–800 scale |
| Languages | English, Spanish, Japanese |
| Eligibility window | Six months after registration |
| Delivery | PSI center or remote proctoring, subject to region |
Candidates in India, mainland China, and Hong Kong currently must take the exam at a testing center because remote proctoring is unavailable there for AAISM. Registration is continuous, and eligibility lasts six months from registration.
The blueprint contains three job-practice domains. AI Technologies and Controls is the largest, but governance and risk together account for 62% of the exam. Purely technical preparation is therefore insufficient.
| Domain | Weight | Core competencies |
|---|---|---|
| AI Governance and Program Management | 31% | Regulation, policy, data life cycle, program oversight, continuity and incident response |
| AI Risk Management | 31% | Risk assessment, thresholds, treatment, threats, vulnerabilities, vendors and supply chains |
| AI Technologies and Controls | 38% | Architecture, model life cycle, data controls, privacy, ethics, safety and monitoring |
The detailed outline includes AI strategy, asset and data life-cycle management, vendor risk, model selection and validation, privacy controls, ethical safeguards, and security monitoring.A strong candidate connects these areas. A generative-AI incident may indicate weak data classification, unclear ownership, inadequate vendor terms, and a missing response process—not merely a technical defect.The best answer will often protect the enterprise control objective rather than offer the fastest isolated fix.
The official AAISM exam cost is US$459 for members and US$599 for non-members. After passing, candidates pay a separate US$50 application fee. Exam fees are nonrefundable and nontransferable.
| Cost item | Member | Non-member |
|---|---|---|
| Exam registration | US$459 | US$599 |
| Certification application | US$50 | US$50 |
| Minimum initial total | US$509 | US$649 |
| Annual maintenance | US$20 | US$35 |
| Optional six-month extension | US$75 | US$75 |
The baseline AAISM certification cost is therefore at least US$509 for members or US$649 for non-members, excluding membership dues, preparation materials, taxes, travel, and retakes.The AAISM certification exam cost is payable again for every attempt. ISACA allows four attempts within a rolling 12-month period, with waiting periods after unsuccessful attempts:
Each attempt requires full payment of the applicable registration fee.When comparing prices, calculate the entire budget. The US$140 examination discount may not by itself justify membership; include membership dues, study-material discounts, CPE use, and other ISACA benefits.
Useful AAISM certification training develops decision quality, not vocabulary recall. It should include:
ISACA offers an official review manual, online review course, free 12-question quiz, and a Questions, Answers and Explanations database containing more than 200 questions.Its virtual workshop runs in two-day or four-day formats and includes the eBook review manual, QAE database, and exam fee.An AAISM certificate is not awarded merely for completing a training course. The AAISM designation requires the qualifying credential, a passing examination result, a formal application, and continuing maintenance.
AAISM holders must report at least 10 relevant CPE hours annually and 30 CPE hours over three years. Annual maintenance costs US$20 for members or US$35 for non-members.
AAISM provides the strongest value when AI security is already part of your work—or is likely to become part of it. It aligns with responsibilities such as:
It is a weaker fit when you do not hold CISM or CISSP, need basic AI literacy, or want deep model-development training.AAISM is an advanced extension of security-management capability, not a substitute for foundational cybersecurity or technical AI skills.
Create a three-column gap assessment: official AAISM task, evidence from your current role, and knowledge still required. Prioritize Domain 3 because it carries the largest weight, but do not neglect governance and risk.Register when you can explain how an enterprise should govern an AI system from business approval through retirement. That is the capability the AAISM certification is intended to validate.