Last updated:
AAISM preparation guide
AAISM vs CISM: which comes first, and what AAISM adds
Direct answer
AAISM is not an alternative to CISM. ISACA opens the AAISM exam only to active CISM or CISSP holders, so a CISM candidate earns CISM first. AAISM then tests the same management judgment applied to AI systems: who owns an AI risk, which stage of the AI life cycle a control belongs to, and what evidence shows a model fits its intended use.
The exams differ in size as well as scope. CISM has 150 multiple-choice questions in four hours; AAISM has 90 in two and a half hours. ISACA reports both on a 200–800 scaled score.
If you hold CISSP but not CISM, you are already eligible for AAISM and do not need CISM first.
Start AAISM baselineCISM and AAISM side by side (checked October 12, 2026)
| Topic | CISM | AAISM |
|---|---|---|
| Who can sit the exam | Anyone; certification then needs five years of information security management experience | Active CISM or CISSP holders only |
| Exam | 150 multiple-choice questions, 240 minutes | 90 multiple-choice questions, 150 minutes |
| Exam fee | US$575 members, US$760 non-members | US$459 members, US$599 non-members |
| Application fee after passing | US$50 | US$50 |
| Content | Four domains; ISACA's updated outline takes effect 3 November 2026 | AI Governance and Program Management 31%, AI Risk Management 31%, AI Technologies and Controls 38% |
| Keeping it | 20 CPE a year and 120 over three years; US$45 members, US$85 non-members a year | 10 CPE a year and 30 over three years; US$20 or US$35 a year for all ISACA Advanced credentials; CISM or CISSP must stay active |
Original teaching example
A bank's fraud team wants to replace its rule-based transaction monitoring with a vendor's machine-learning model. The vendor shares accuracy results from its other customers. The security manager is asked whether the model can go live next month.
A CISM answer starts with risk ownership, a business case and an assessment. AAISM keeps that and adds the AI fact that changes the answer: the vendor's results come from other banks' data, so the bank needs validation evidence on its own transactions for its intended use, and an owner for monitoring drift after go-live. The tempting answer accepts the vendor's figures because the vendor is reputable.
What carries over from CISM
Governance before tools, risk ownership with the business, and the step that fits the current decision point.
AAISM Domain 1 (AI governance and program management) and Domain 2 (AI risk management) extend that thinking to AI systems. The AI fact in the scenario is what changes the answer.
Where each AAISM subarea starts from
Domains 1 and 2 build on CISM. Domain 3, 38% of the exam, has no direct CISM counterpart.
1A to 1D (stakeholders and regulation, AI strategy and policy, the AI asset and data life cycle, the AI security program) build on CISM governance and program work. 1E (business continuity and incident response) builds on CISM incident management. 2A to 2C (AI risk assessment and treatment, AI threats and vulnerabilities, AI vendors and the supply chain) build on CISM risk management, including third-party risk.
Domain 3 covers AI security architecture, the AI life cycle, data management controls, privacy, ethics, trust and safety controls, and monitoring. Plan most of your new study time there.
Passing the CISM exam is not enough
AAISM is open to active CISM holders, which means CISM certification, not only a passed exam.
CISM certification needs ISACA's experience requirement as well as the exam. If your CISM application is still pending, CISSP is the only other route into AAISM.
If you hold CISSP, or neither
A CISSP holder can sit AAISM now. Without either credential, AAISM is two exams away.
CISSP holders should expect ISACA's manager-first answer style. If you hold neither, choose CISM or CISSP on its own merits; either one opens AAISM.
Sources and fact check
Source checked: 2026-10-12
- ISACA AAISM certification page
- ISACA AAISM certification requirements
- ISACA AAISM Exam Candidate Guide
- ISACA AAISM maintenance requirements
- ISACA CISM certification page
- ISACA CISM certification requirements
- ISACA Certification Exam Candidate Guide
- ISACA CISM maintenance requirements
- ISACA CISM Exam Content Outline
- Study methods and examples are independent CertArc teaching guidance. ISACA's pages are the authority for exam rules and fees, which can change.
- Practice results do not convert to an official score or guarantee a pass. CertArc is not affiliated with or endorsed by ISACA.
Frequently asked questions
Do I need CISM to take AAISM?
No, if you hold an active CISSP. Otherwise you need an active CISM.
Can I sit AAISM after passing the CISM exam but before certification?
No. ISACA opens AAISM to active CISM holders, so you need the CISM certification itself.
Is AAISM harder than CISM?
ISACA's AAISM pages and candidate guide give no pass rate, so there is no data to compare. AAISM is shorter, at 90 questions against 150, and adds AI technologies and controls at 38% of the exam.
What happens to AAISM if my CISM lapses?
Keeping AAISM requires proof of an active CISM or CISSP. ISACA revokes AAISM if certification requirements are not met.
Can the same CPE hours count for both?
Yes, when the activity is relevant to each certification, ISACA allows the same hours to count for several of them.
