Last updated:
AAISM preparation guide
Is AAISM worth it? A decision by the credential you already hold
Direct answer
AAISM is worth considering if you already hold CISM or CISSP and your role includes governing, securing or approving AI systems. It is ISACA's AI security management credential, announced in August 2025, and it builds on the credential you hold rather than replacing it. If your work is AI audit, AI risk reporting or privacy-led AI governance, ISACA's AAIA or AAIR, or IAPP's AIGP, may fit better.
CertArc doesn't publish AAISM salary figures. We found no salary survey that reports AAISM holders separately (checked October 12, 2026); figures quoted elsewhere are estimates for AI security roles in general.
The required cost is US$509 for an ISACA member or US$649 for a non-member (the exam plus the US$50 application fee), then US$20 or US$35 a year to maintain.
Start AAISM baselineIs AAISM a good next step for you?
| You hold | Your work | Fit |
|---|---|---|
| CISM | Security governance, program or risk leadership, with AI systems arriving | Strong: AAISM extends the governance and risk judgment you already use |
| CISSP | Security architecture or engineering leadership | Good: expect ISACA's manager-first style; Domain 3 includes AI security architecture and design |
| CISM or CISSP, assessing AI risk | Mainly assessing and reporting AI risk to risk committees | Compare with AAIR, which also accepts CISM and CISSP holders |
| CISA, or a listed audit or accounting designation | AI audit or assurance | Look at AAIA, ISACA's AI audit credential; AAISM needs CISM or CISSP |
| No ISACA or ISC2 credential | Privacy, legal or policy-led AI governance | Look at IAPP's AIGP; its exam page lists no prerequisite credential |
| CISM or CISSP, no AI in scope | No AI systems in your scope for the next year | Not worth it yet: you would study without using it, and the annual AI CPE starts the calendar year after you certify |
Original teaching example
A hospital group is adding an AI tool that prioritizes radiology scans. Its CISM-certified security manager must decide what has to be true before the tool goes live. Its CISA-certified internal auditor will later test whether those controls work.
The manager's decisions (ownership, life-cycle controls, oversight and monitoring) are AAISM ground. The auditor's independent assurance is AAIA ground. Choose the credential that matches the work you own.
What AAISM shows an employer
That ISACA has examined your AI security management judgment on top of an existing CISM or CISSP.
The exam covers AI governance and program management, AI risk management, and AI technologies and controls. ISACA's page describes the credential as globally accepted and recognized. Check job postings in your own market before assuming employers ask for it by name.
When it's not worth it yet
When your CISM or CISSP is not yet certified, or no AI system will be in your scope soon.
Start with the base credential first. Without AI work to apply it to, the 10 hours of AI CPE a year become a cost without a use.
What it costs to hold
US$20 or US$35 a year, plus keeping your CISM or CISSP active.
That one maintenance fee covers every ISACA Advanced credential you hold. Your CISM or CISSP keeps its own maintenance requirements.
Reading reviews and Reddit threads
Pass stories help with logistics. Check any exam fact against ISACA's pages.
Check whether a page sells a course or a question bank. Some popular guides give the wrong exam length or retake rules; ISACA's candidate guide is the authority.
Sources and fact check
Source checked: 2026-10-12
- Study methods and examples are independent CertArc teaching guidance. ISACA's pages are the authority for exam rules and fees, which can change.
- Practice results do not convert to an official score or guarantee a pass. CertArc is not affiliated with or endorsed by ISACA.
Frequently asked questions
Is AAISM recognized?
ISACA describes it as globally accepted and recognized. It was announced in August 2025.
How much does AAISM raise salary?
We found no survey that reports AAISM holders separately, so CertArc publishes no figure.
Can I get AAISM without CISM?
Yes, with an active CISSP.
AAISM or AAIR?
Both accept CISM and CISSP holders. Choose AAISM if you decide which controls an AI system needs, and AAIR if you mainly assess and report AI risk.
How long does AAISM take to prepare for?
It depends on your starting point and the time you can protect. Start with the baseline and let your results set the plan.
