Before approving enterprise use of a public generative AI service, the security manager should FIRST:
Domain 1
Answer: B · whyRisk-based evaluation and policy come before enabling or blocking.
ISACA · AI Security Management
AAISM - ISACA Advanced in AI Security Management
Security managers and leaders (CISM or CISSP holders) who govern, assess and secure enterprise AI.
Overview
- Prerequisites
- Must hold an active CISM or CISSP. US$50 application fee after passing.
- Maintenance
- ISACA Advanced-certification policy: at least 10 CPE hours a year and 30 over a 3-year cycle in the AI specialty, keep the prerequisite certification active, and pay one annual maintenance fee of US$20 (members) / US$35 (non-members) that covers all ISACA Advanced certifications held. (AAISM also requires proof of an active CISM or CISSP.)
- Outline in effect
- check official site
Exam duration taken from a copy of ISACA's AAISM candidate guide hosted by a training provider; confirm on isaca.org.
Exam facts
- Questions
- 90
- Duration
- 2.5 hours (150 minutes) - per ISACA AAISM candidate guide; confirm on official site
- Question types
- Multiple choice
- Passing score
- 450 on a 200-800 scaled score (ISACA standard scale; confirm on official site)
- Format
- Linear, computer-based
- Delivery
- PSI test centres or remote proctoring (test centre only for residents of India, mainland China and Hong Kong)
Cost
- Member
- US$459
- Non-member
- US$599
- Notes
- Plus US$50 application fee.
Domains & weights
- Domain 1 - AI Governance and Program Management31%
- Domain 2 - AI Risk Management31%
- Domain 3 - AI Technologies and Controls38%
Upcoming changes
No announced changes as of 19 Oct 2026.
Study plan
- Week 1
Domain 1
- Stakeholders, frameworks and regulations; AI strategy, policy and procedures; AI asset and data life cycle; AI security programme; BC and incident response for AI.
- Week 2
Domain 2
- AI risk assessment, thresholds and treatment; AI threat and vulnerability management; AI vendor and supply chain.
- Week 3
Domain 3 (part 1)
- AI security architecture and design; model life cycle (selection, training, validation).
- Week 4
Domain 3 (part 2)
- Data management controls; privacy, ethics, trust and safety controls; security monitoring for AI (OWASP LLM Top 10, MITRE ATLAS).
- Week 5
Policy and programme case study
- Write an AI acceptable-use policy and an AI security standard for a sample enterprise.
- Build a one-page AI security programme roadmap and a board-level risk report.
- Week 6
AI security operations
- AI red teaming and adversarial testing, monitoring for model drift and abuse, AI incident playbooks.
- Map OWASP Top 10 for LLM Applications and MITRE ATLAS techniques to controls you would mandate.
- Week 7
Practice
- ISACA free practice exam + QAE; timed 90-question mock.
- Week 8
Review
- Focus on Domain 3 (38%).
Exam tips
- Read every question for the role you are playing (auditor, risk practitioner, security manager): ISACA rewards the answer that fits that role, not the most technical one.
- Watch qualifier words such as FIRST, BEST, MOST, PRIMARY and GREATEST: several options are often true, and only one is the best next step.
- There is no penalty for wrong answers, so never leave a question blank.
- Answer as a security manager: align AI security with business objectives and risk appetite.
Common pitfalls
- Going too technical on ML maths.
- Ignoring AI supply-chain and vendor risk.
- Letting your CISM/CISSP lapse (required to keep AAISM).
Resources & official links
Official
Also widely used
- OWASP Top 10 for LLM Applications
- MITRE ATLAS
- NIST AI 100-2 adversarial ML taxonomy
- NIST Cyber AI Profile (IR 8596, draft)
Sources
- ISACA AAISM page (prerequisites, fees)
- AAISM Exam Content Outline
- ISACA press release: AAISM launched (19 Aug 2025)
- Maintain AAISM
Last verified 19 Oct 2026. Values marked “check official site” could not be confirmed from an official source.
Practice questions
Which asset is UNIQUE to AI systems and must be inventoried and protected?
Domain 1
Answer: B · whyModels, weights and training data are high-value AI assets.
An attacker queries a model repeatedly to reconstruct it. This is:
Domain 2
Answer: A · whyModel extraction uses query access to replicate a model.
Which control BEST limits damage if an AI agent is manipulated by prompt injection?
Domain 3
Answer: B · whyLimiting what the agent can do reduces blast radius.
AI vendor risk assessment should include:
Domain 2
Answer: B · whyAI supply-chain risk covers data use, testing, notification and fourth parties.
Which metric BEST indicates the effectiveness of AI security controls?
Domain 1
Answer: B · whyOutcome metrics on control performance are most useful.
Differential privacy is MAINLY used to:
Domain 3
Answer: B · whyIt adds calibrated noise to protect individuals' data.
AI incidents (e.g., harmful outputs at scale) should be handled by:
Domain 1
Answer: B · whyAI needs specific playbooks within the existing IR process.
Where should AI security requirements be embedded FIRST in an internal AI project?
Domain 3
Answer: B · whySecure-by-design is cheaper and more effective than retrofitting.
Which BEST supports human oversight of AI outputs?
Domain 3
Answer: B · whyRisk-based human-in-the-loop controls oversee critical outputs.