Last updated:
AAISM preparation guide
How hard is the AAISM exam? A guide for CISM and CISSP holders
Direct answer
AAISM is a 90-question, 150-minute scenario exam open only to holders of an active CISM or CISSP, so you start with most of the management judgement it tests; the new part is applying it to AI systems. The material most different from CISM and CISSP is AI Technologies and Controls, 38% of the exam. ISACA publishes no pass rate, but it offers a free 12-question quiz it describes as the same level of difficulty as the exam, the best way to judge it for yourself.
Difficulty depends on what you bring. AAISM asks you to apply governance, risk and security-programme thinking to AI systems across their life cycle: data and models, testing and attacks, monitoring and vendors.
Leaving an ISACA exam unsure is normal: the questions are built so that two options look reasonable.
Start AAISM baselineAAISM in numbers, from ISACA (checked 2 November 2026)
| Question | What ISACA says |
|---|---|
| Format | 90 multiple-choice questions in 150 minutes, about 100 seconds each |
| Scoring | A scaled score from 200 to 800, based on the scored questions answered correctly; ISACA's candidate guide sets the passing standard, and pretest items do not count |
| Domain weights | AI Governance and Program Management 31%, AI Risk Management 31%, AI Technologies and Controls 38% |
| Domain results | Informational only; no domain is passed or failed on its own |
| Wrong answers | No penalty, so answer every question |
| Official sample | A free 12-question quiz at "the same level of difficulty" as the exam |
| Who can sit it | Holders of an active CISM or CISSP |
| Pass rate | Not published by ISACA |
| Retakes | Four attempts in a rolling 12 months, waiting 30, then 90, then 90 days; full fee each time |
Original teaching example
A practice question: a business unit wants to roll out a vendor's generative AI assistant next week. The vendor's security summary looks strong, but no one has assessed how the assistant handles company data.
A manager-level answer starts with assessing the risk and getting governance approval before adoption, not with a technical control or with trusting the vendor's summary. That ordering, risk before approval and approval before use, is the kind of judgement AAISM tests across all three domains.
If you hold CISM
You know the question style; the AI content is the new part.
CISM already asks what a security manager should do first, best or most. AAISM keeps that point of view, so spend most of your time on AI Technologies and Controls and on how risk work changes for AI systems. The AAISM vs CISM guide compares the two exams side by side.
If you hold CISSP rather than CISM
ISACA's question style may be new.
The best ISACA answer usually puts governance and risk assessment before a technical control, and a habit of reaching for the strongest control can pick the wrong option. ISACA's free quiz and the explanations in its QAE are the quickest way to learn the style. For both groups, AI Technologies and Controls is the domain furthest from CISM and CISSP.
How technical is AAISM?
Technical enough to need AI vocabulary, but written for managers.
ISACA's outline for AI Technologies and Controls covers model selection, training and validation, the AI threat landscape, and testing and vulnerability management. The questions still ask what a security manager should decide: assess, approve, monitor or escalate.
What makes it feel hard
Plausible options, and AI terms that look alike.
Like other ISACA exams, AAISM asks for the best of several reasonable options, so two answers can both look right. The stronger one usually acts at the right stage of the AI life cycle, for the right owner, on evidence that fits. CertArc's six AAISM decision-trap guides walk through these patterns.
About pass rates and scores
ISACA gives no pass rate, and the scaled score is not a percentage.
If a page quotes a pass rate, check whether it links to ISACA; none of ISACA's AAISM pages give one. The scaled score puts different versions of the exam on one scale. One weaker domain is not an automatic fail, though every domain counts toward the total.
How to tell if you are ready
Your results on new questions are a steadier guide than how you feel on a given day.
Look for steady results across all three domains, sure answers that hold up, and misses you can explain. CertArc's readiness page walks through the rest of the evidence.
Sources and fact check
Source checked: 2026-11-02
- Study methods and examples are independent CertArc teaching guidance. ISACA's pages are the authority for exam rules and fees, which can change.
- Practice results do not convert to an official score or guarantee a pass. CertArc is not affiliated with or endorsed by ISACA.
Frequently asked questions
How hard is the AAISM exam?
ISACA publishes no pass rate or difficulty ranking. It says its free 12-question quiz is at the same level of difficulty as the exam, so the quiz is the best first test. The domain furthest from CISM and CISSP is AI Technologies and Controls.
What is the AAISM passing score?
ISACA reports a scaled score from 200 to 800 and sets the passing standard in its candidate guide. The scaled score is not a percentage.
Do I need to be technical to pass AAISM?
You need AI vocabulary and to understand how AI systems are built, tested and attacked, because AI Technologies and Controls is 38% of the exam. The questions still ask what a manager should do.
Is AAISM harder for CISSP holders than CISM holders?
ISACA publishes no data on that. CISM holders already know ISACA's question style; CISSP holders may need some practice with it first.
How many questions are on the AAISM exam?
90 multiple-choice questions in 150 minutes.
Can I retake AAISM if I don't pass?
Yes: four attempts in a rolling 12 months, waiting 30, then 90, then 90 days, paying the full fee each time.
