The AAISM Certification (Advanced in AI Security Management™) by ISACA is an advanced AI security management certification designed to validate expertise in governing, securing, and managing enterprise artificial intelligence systems. Candidates must meet strict AAISM prerequisites, holding an active CISM or CISSP credential. The exam costs $459 for ISACA members ($599 for non-members) and features 90 scenario-based questions over 150 minutes, requiring a scaled 450/800 passing score across three ISACA AAISM domains covering AI governance, risk, and technical security controls.
What is the ISACA AAISM Certification?
As enterprise adoption of generative AI, autonomous agentic workflows, and machine learning models accelerates, traditional cybersecurity controls often prove inadequate against specialized threat vectors like prompt injection, model poisoning, and training data extraction. The Advanced in AI Security Management (AAISM) credential serves as the industry’s first specialized, vendor-neutral qualification designed specifically to manage the entire enterprise AI security lifecycle.
Developed by ISACA, the credential equips information security managers, risk leads, and executive security advisors to design robust governance frameworks and deploy defensive controls across AI pipelines. Whether self-studying or preparing through classroom instruction like the AAISM certification in New York, earning this qualification establishes proven technical and governance leadership in an increasingly automated risk environment.
Mandatory AAISM Prerequisites and Certification Requirements
Unlike entry-level certifications, ISACA enforces strict baseline eligibility standards to ensure candidates already possess foundational information security management expertise before specializing in AI threats.
Eligibility Criteria
To register for and earn the credential, candidates must satisfy the following AAISM certification requirements:
Active Prerequisite Credential: Candidates must hold an active CISM (Certified Information Security Manager) or CISSP (Certified Information Systems Security Professional) designation in good standing.
Professional Experience: Because CISM and CISSP require five years of verified security management or engineering experience, the AAISM credential inherits this senior background.
Continuous Good Standing: Your prerequisite CISM or CISSP designation must remain active throughout the application cycle.
Post-Exam Qualification Steps
Passing Score: Achieve a scaled score of 450 out of 800 on the official exam.
Application Processing Fee: Pay a one-time $50 USD application fee upon passing.
Code of Ethics: Formally agree to adhere to ISACA’s Code of Professional Ethics and Continuing Professional Education (CPE) policy.
Breaking Down the 3 ISACA AAISM Domains
The exam curriculum covers three job-practice domains that reflect real-world responsibilities required to manage enterprise AI deployments securely.
| Exam Domain | Weight | Focus Areas & Key Competencies | Real-World Application Scenario |
|---|---|---|---|
| Domain 1: AI Governance & Program Management | 31% | AI strategy alignment, ethical frameworks, policy design, stakeholder reporting, and governance metrics (KPIs/KRIs). | Establishing corporate acceptable use policies for LLMs and auditing third-party vendor AI integrations. |
| Domain 2: AI Risk & Opportunity Management | 31% | Threat modeling, risk assessments (PIAs), red teaming, supply chain security, and adversarial machine learning vectors. | Conducting impact assessments for autonomous agent workflows and establishing risk tolerance thresholds. |
| Domain 3: AI Technologies & Controls | 38% | AI architecture design, data integrity, privacy controls, continuous monitoring, guardrails, and incident response. | Implementing input/output guardrails against prompt injection and preventing training data extraction. |
Exam Specifications, Format, and Cost Analysis
Understanding exam mechanics helps candidates budget time and financial resources accurately.
Question Volume: 90 multiple-choice and scenario-based items
Time Allotment: 150 minutes (2.5 hours)
Delivery Method: Computer-Based Testing (CBT) via live remote proctoring or in-person at authorized PSI testing centers globally.
Eligibility Period: Candidates have 6 months from the date of registration to schedule and sit for the exam.
Financial Breakdown
ISACA Member Exam Fee: $459 USD
Non-Member Exam Fee: $599 USD
Application Processing Fee: $50 USD
Annual ISACA Professional Membership (Optional): ~$135 USD (Joining prior to exam purchase yields net savings on study materials and voucher fees).
Candidates can verify official registration procedures and policies directly on the ISACA Official Website.
How to Build an Effective ISACA AAISM Study Guide
Preparing for a scenario-based exam requires bridging high-level governance concepts with practical AI threat vectors. Follow this structured prep framework:
Perform a Prerequisite Knowledge Audit:
CISM Holders: Leverage your strength in governance and risk assessment, but dedicate extra study time to Domain 3 (AI Technologies and Controls), focusing on pipeline architectures, vector databases, and guardrails.
CISSP Holders: Capitalize on your technical security background, but align your study strategy with ISACA-specific governance terminology, risk scoring, and metric design in Domain 1.
Master Adversarial ML Frameworks: Study practical frameworks including the OWASP Top 10 for Large Language Model Applications and the NIST AI Risk Management Framework (AI RMF 1.0). Understand how model inversion, membership inference, data poisoning, and indirect prompt injection function.
Practice Scenario Resolution: Work through official AAISM practice exam questions to build familiarity with decision-based item formats. Focus on identifying the "BEST," "MOST effective," or "FIRST" administrative action in given enterprise contexts.
Follow a Domain-Centric Schedule: Allocate two weeks to each of the three domains, reserving a final week for full-length timed mock exams and targeted domain review.
Career Value, Salary ROI, and CPE Maintenance
As organizations race to deploy intelligent systems, certified AI security managers bridge the gap between technical engineering teams and executive risk leadership.
Prospective Career Roles & Salary Averages
AI Security Manager / Lead Architect: $145,000 – $195,000
Chief Information Security Officer (CISO): $180,000 – $260,000+
Enterprise AI Risk & Governance Lead: $135,000 – $180,000
AI Security & Compliance Consultant: $130,000 – $175,000
Maintaining Active Status
Once certified, professionals must maintain their designation by completing the following annual requirements:
Earn and report a minimum of 10 CPE hours annually in specialized AI topics (and 120 CPE hours total over a 3-year cycle across your ISACA credentials).
Pay the annual maintenance fee ($45 USD for members / $85 USD for non-members).
Maintain your underlying CISM or CISSP prerequisite credential in active status.
Execution Blueprint for Candidates
To begin your certification journey, log into your MyISACA account to verify that your CISM or CISSP status is active. Download the official exam content outline, conduct a gap assessment across the three practice domains, and begin working through scenario-based practice questions to secure your position as a trusted enterprise AI security leader.