Last updated:
AAISM preparation guide
AAISM study resources: where to start and what to review
Direct answer
Start with the gap you can name. If you are new to AI security, begin with the domain guides; if you know the material but run out of time, start with the study plan; if you are unsure whether you can sit the exam, read the eligibility guide first.
ISACA's outline is the coverage checklist. CertArc's guides explain how each part is tested in scenarios and where candidates with a CISM or CISSP background tend to slip.
Use authoritative material to learn an unfamiliar AI concept, then practise applying it. Review time is part of the work, not extra.
Start AAISM baselineAAISM guides
Start here
The three domains
Exam facts and cost
Compare credentials
Practice and exam technique
AI decision traps
- AAISM life-cycle trap: the right control at the wrong stage
- AAISM vendor trap: the provider's evidence is not yours
- AAISM oversight trap: a human in the loop is not oversight by itself
- Prompt injection vs data poisoning: match the control to where the attacker acts
- AAISM monitoring trap: who acts after go-live?
- AAISM validation trap: strong accuracy on the wrong test
Choose a guide by the gap you need to close
| If you need to… | Read |
|---|---|
| Govern AI use, write policy, run an AI security program | AI Governance and Program Management |
| Assess AI risk, handle threats, manage AI vendors | AI Risk Management |
| Choose controls across the model lifecycle | AI Technologies and Controls |
| Check eligibility, fees, retakes and scoring | Eligibility and exam format |
| Fit study and review into your weeks | AAISM study plan |
Original teaching example
You hold CISM and score well on governance, but miss questions about model validation.
Read the AI Technologies and Controls guide, study validation in subarea 3B (the AI life cycle), then retest with a focused sprint before moving on. This is a planning example, not a required schedule.
ISACA's official AAISM materials
ISACA sells a Review Manual, a QAE database, an Online Review Course and a Virtual Workshop, and offers a free quiz.
Use them for what each is good at: the Review Manual to learn a concept, the QAE (a six-month subscription to 200+ questions) and ISACA's free 12-question quiz to see the official question style, and the course or workshop if you want instruction. Members can also join ISACA's Engage study groups.
Avoid copied questions
CertArc never links to copied manuals or “real exam question” sites.
ISACA has a zero-tolerance policy for fraudulent test-taking and can nullify a score or revoke a certification. Original practice tests the same judgment without that risk.
Keep official facts and teaching advice separate
ISACA's pages set the rules; CertArc's guides explain how to apply them.
Every guide lists the ISACA pages it was checked against. Study methods and examples are CertArc's own.
Build a small review loop
Learn a concept, practise it, review why you missed.
Tag each miss with a reason, then return to the guide for that gap before the next sprint.
Sources and fact check
Source checked: 2026-10-22
- Study methods and examples are independent CertArc teaching guidance. ISACA's pages are the authority for exam rules and fees, which can change.
- Practice results do not convert to an official score or guarantee a pass. CertArc is not affiliated with or endorsed by ISACA.
Frequently asked questions
Do I need to read every guide?
No. Use them to close specific gaps; the outline still sets what to cover.
Are the guides official ISACA material?
No. They are independent CertArc guides with original examples.
Where do I start if I am short on time?
Take the baseline, then read the guide for your weakest domain.
Which official ISACA resources exist for AAISM?
A Review Manual (print and digital), the QAE database, an Online Review Course, a Virtual Workshop, a free 12-question quiz, and Engage study groups for members.
Can I read the guides without an account?
Yes. The guides are free to read.
