Last updated:
AAISM preparation guide
AAISM vs CAISP: AI security management or hands-on AI security?
Direct answer
AAISM and CAISP test different jobs. ISACA's AAISM is a management credential for active CISM or CISSP holders: 90 multiple-choice questions on governing, assessing and controlling AI systems. Practical DevSecOps' CAISP is a training course and hands-on exam, mainly for people who test and defend AI systems: five lab challenges in six hours, then a written report, with no prerequisite credential. Passing CAISP does not make you eligible for AAISM; only an active CISM or CISSP does.
Each credential's facts come from its issuer's own pages: ISACA for AAISM, and Practical DevSecOps for CAISP.
CertArc is independent and not affiliated with ISACA or Practical DevSecOps. CertArc offers AAISM practice, not CAISP.
Start AAISM baselineAAISM and CAISP side by side (checked October 27, 2026)
| Topic | AAISM (ISACA) | CAISP (Practical DevSecOps) |
|---|---|---|
| What you buy | An exam; you choose how to prepare | A self-paced course, with one exam attempt included |
| Who can take it | Active CISM or CISSP holders | No prerequisite credential; the course asks for basic Linux command-line skills, and scripting helps |
| Exam | 90 multiple-choice questions, 150 minutes; English, Spanish or Japanese | Five practical challenges in 6 hours, then 24 hours to submit a written report |
| Scoring | A scaled score from 200 to 800 | Points for the challenges you complete and the report you submit |
| Where | PSI test centres or remote proctoring; some regions are test-centre only | An online lab, from home or the office |
| Price | US$459 for members or US$599 for non-members, plus a US$50 application fee after passing | US$1,099 list price for the course, 60 days of browser labs, 3 years of video access and one exam attempt; sale prices vary (US$934.15 on October 27, 2026) |
| Retakes | Four attempts in 12 months, at the full fee each time | US$100 per retake; no limit stated |
| Keeping it | 10 CPE a year in AI and 30 over three years, plus US$20 or US$35 a year; CISM or CISSP must stay active | No renewal: Practical DevSecOps describes it as lifetime |
| Focus | AI governance and program management 31%, AI risk management 31%, AI technologies and controls 38% | Attacking LLMs and the OWASP LLM Top 10, AI threat modelling, AI supply chain attacks, AI attacks and defences using DevOps, and AI governance and compliance |
Original teaching example
A retailer is about to launch a support assistant built on a large language model. It answers questions by retrieving customers' order records. The CISO asks who owns the risk, whether it fits the board's appetite and what evidence is needed before launch. The application security team asks whether text inside a customer's message could make the assistant reveal someone else's order, and how to prove it can't.
AAISM tests the CISO's questions: risk ownership, treatment, life-cycle controls and the evidence that monitoring works after launch. CAISP trains and tests the team's questions: running prompt-injection attacks against the assistant, threat-modelling the retrieval step and fixing what the test finds. Both credentials care about the same failure, but they act on it at different levels.
CAISP does not open the AAISM exam
Only an active CISM or CISSP does.
ISACA opens AAISM to active CISM or CISSP holders and lists no other route. If you hold CAISP but neither of those, AAISM is two steps away: CISM or CISSP first, then AAISM.
Who should pick AAISM
Security managers who hold CISM or CISSP and own decisions about AI systems.
If your job is to approve an AI system, set policy for it, judge its risk or choose its controls, AAISM tests those decisions. The exam asks for the best management answer, not for hands-on work.
Who should pick CAISP
Practitioners who test, build or defend AI systems.
Practical DevSecOps names application security engineers, AI red teamers, AI security engineers and architects, DevSecOps engineers and MLOps engineers, and lists AI governance and AI risk analyst among the jobs it prepares you for. The exam is graded on the challenges you complete in a lab and the report you submit.
How each exam tests you
AAISM asks you to choose; CAISP asks you to do.
An AAISM question, often a scenario, has four options, and the best answer is usually the step that fits the decision you are at. A CAISP challenge is a task in a lab, and you write up your findings in a report afterwards. Practical DevSecOps does not allow chatbots such as ChatGPT during its exams.
Cost over three years
AAISM costs less to sit, but it depends on a credential you must keep.
AAISM: up to US$569 for an ISACA member (US$459 exam, US$50 application, 3 × US$20 maintenance) or up to US$754 for a non-member (US$599, US$50, 3 × US$35). ISACA bills maintenance each year, so whether a three-year window holds two or three fees depends on when you certify. Add the upkeep of your CISM or CISSP and any preparation you buy. Member prices require ISACA membership, which has its own fee.
CAISP: US$1,099 at list price, including the training. There is nothing to renew, and a retake costs US$100.
Facts some guides get wrong
The AAISM exam is 150 minutes, and CAISP asks for some technical skills.
Some guides give AAISM 180 minutes; ISACA's candidate guide says 150. Some summaries say CAISP has no prerequisite. It needs no prior credential, but its course page asks for basic Linux command-line skills.
Holding both
They come from different organisations, with separate rules.
Holding both makes sense if you manage AI security and still test AI systems yourself. Practical DevSecOps says CAISP awards 36 CPE points. ISACA decides which activities count toward AAISM's CPE, so check its CPE policy before you count them.
Sources and fact check
Source checked: 2026-10-27
- ISACA AAISM certification page
- ISACA AAISM certification requirements
- ISACA AAISM Exam Candidate Guide
- ISACA AAISM maintenance requirements
- ISACA AAISM Exam Content Outline
- Practical DevSecOps CAISP course page
- Practical DevSecOps exam and certification process
- Practical DevSecOps exam retake
- CAISP badge on Credly (issued by Practical DevSecOps)
- Study methods and examples are independent CertArc teaching guidance. ISACA's pages are the authority for exam rules and fees, which can change.
- Practice results do not convert to an official score or guarantee a pass. CertArc is not affiliated with or endorsed by ISACA.
Frequently asked questions
Does CAISP count toward AAISM eligibility?
No. AAISM needs an active CISM or CISSP.
Which is harder?
Neither issuer publishes a pass rate on its pages, so there is no data to compare. The formats differ: AAISM is 90 multiple-choice questions in 150 minutes, and CAISP is five practical challenges in 6 hours plus a report.
Does CAISP expire?
No. Practical DevSecOps describes it as lifetime, with no renewal. AAISM needs CPE, an annual fee and an active CISM or CISSP.
Is CAISP accredited by an outside body?
Practical DevSecOps' pages name no outside accrediting body for CAISP; it issues the credential itself, as ISACA does for AAISM.
Can I take CAISP without a security job?
There is no prerequisite credential. The course asks for basic Linux command-line skills, and Practical DevSecOps says most learners already work in security.
Does CertArc offer CAISP practice?
No. CertArc offers AAISM practice and is independent of ISACA and Practical DevSecOps.
