Last updated:
AAISM preparation guide
Build an AAISM study plan around coverage and review
Direct answer
Plan around the study days you can protect, coverage of all three domains and time to review answers. Start from your baseline, work through each domain's foundation, application and mastery sprints, and move practice exams in as your coverage grows.
CertArc's AAISM route has six 25-question sprints per domain (two foundation, two application, two mastery), ten 30-question practice exams, five 50-question mocks and a 25-question final check. Your calendar spreads these to your exam date.
Coming from CISM or CISSP, you may move through governance quickly and need more time on lifecycle controls. Let your results, not the order of the outline, decide where extra time goes.
Start AAISM baselineA study cycle you can fit to your calendar
| Stage | Work | Evidence to move on |
|---|---|---|
| Establish a baseline | Answer, rate your confidence, read the review | A named starting gap, not only a score |
| Repair a topic | Study the concept, then a focused sprint | You can explain the owner and lifecycle stage in a new scenario |
| Mix the domains | Practice exams without topic hints | Your reasoning holds across domains |
| Reassess | Review recurring miss reasons and untouched topics | Next week's calendar reflects both |
Original teaching example
You have three evenings this week and three sprints scheduled, but last session's review still has answers you cannot explain.
Use one evening for that review, one for the concept and a focused sprint, and one for a different domain. This is a planning example, not a required schedule.
Use the weights, keep the coverage
Domain 3 carries 38%, but every domain is tested. Cover all three, then give extra time where your results show gaps.
Keep the calendar honest
Move the plan when your time changes. A calendar date is guidance, not a promise of readiness.
Where to start, by the credential you hold
Start where your existing credential helps least, then keep all three domains covered.
- CISM holder: start with Domain 3, then the vendor and threat subareas of Domain 2.
- CISSP holder: start with Domain 1 governance, to get used to ISACA's manager-first style.
- CISSP holder who works with AI or machine learning: start with Domain 1, then Domain 2.
Let the baseline overrule the plan
These are starting points, not rules.
If your baseline shows a different gap, start there. Your results, not your job title, decide where extra time goes.
Sources and fact check
Source checked: 2026-10-12
- Study methods and examples are independent CertArc teaching guidance. ISACA's pages are the authority for exam rules and fees, which can change.
- Practice results do not convert to an official score or guarantee a pass. CertArc is not affiliated with or endorsed by ISACA.
Frequently asked questions
Can I prepare in 30 or 90 days?
It depends on your starting point and time. An access period is a window, not a guarantee it is enough.
Should I study only my weakest domain?
No. Give it extra attention and keep all three covered.
Should review time be scheduled?
Yes. A plan of only new questions understates the work.
Does the calendar unlock paid modules?
No. Dates do not change your access.
Where should a CISM holder start?
Usually with Domain 3, where CISM experience helps least, unless your baseline shows a different gap.
