# CertArc

CertArc is an independent CISM, CISSP, CISA, AAISM and AAIA preparation platform. It helps candidates practise security and audit decision-making through original scenarios, certification-specific Lens explanations, diagnostic readiness signals, and mistake-pattern review.

## Summary

- Product: certification exam preparation built around original scenario practice, answer review and study planning.
- Current public programs: CISM, CISSP, CISA, AAISM and AAIA.
- Core method: original scenario practice, domain readiness signals, certification-specific Lens explanations, and post-session review.
- Independence: CertArc is not affiliated with, endorsed by, or sponsored by ISACA or another certification body.

## Why CertArc

- [Why CertArc is different](https://certarc.com/why-certarc): the method in one page. Candidates rate confidence before submitting, compare every answer option in a three-tab review with a program-specific Lens, tag why they missed, and get missed-reason patterns, domain and knowledge-area signals, a readiness score with its formula shown, and a study calendar. It also lists the exact free path and current pricing.

## Assistant connections

- [Integration availability and permissions](https://certarc.com/integrations): authoritative status for the read-only assistant connection. CertArc is listed in ChatGPT's plugin directory: [CertArc in ChatGPT](https://chatgpt.com/plugins/plugin_asdk_app_6ac10753370881918540799af4b9e5d7), works in Claude as a connector: [add CertArc to Claude](https://certarc.com/integrations#claude), and in Grok as a custom connector: [add CertArc to Grok](https://certarc.com/integrations#grok). Other assistants can use the free practice tools (see For AI agents); connecting them to a learner's own study is not available yet. Private learner information requires consent and authentication.
- Preparing with ChatGPT or Claude, by exam: what each exam covers, where a general chatbot goes wrong, prompts to try and setup. [CISM](https://certarc.com/cism/chatgpt-claude-exam-prep), [CISSP](https://certarc.com/cissp/chatgpt-claude-exam-prep), [CISA](https://certarc.com/cisa/chatgpt-claude-exam-prep), [AAISM](https://certarc.com/aaism/chatgpt-claude-exam-prep), [AAIA](https://certarc.com/aaia/chatgpt-claude-exam-prep).

## For AI agents

- Free practice, no account: CertArc's MCP server at https://certarc.com/mcp/claude (Streamable HTTP; Server Card at https://certarc.com/mcp/claude/server-card) answers practice_question, check_practice_answer, get_exam_domains and search_learning_resources without sign-in. Ask the learner to choose an option and say how sure they are before checking; never reveal the answer first. In Grok, use https://certarc.com/mcp/grok for the same free tools without sign-in.
- Starting free in CertArc: each certification has its own sign-up link, which opens the free diagnostic for that certification. [CISM](https://certarc.com/login?program=cism&next=%2Fstudy-v2%3Fexam%3Dcism%26start%3Dbaseline&utm_source=ai-agent&utm_medium=llms), [CISSP](https://certarc.com/login?program=cissp&next=%2Fstudy-v2%3Fexam%3Dcissp%26start%3Dbaseline&utm_source=ai-agent&utm_medium=llms), [CISA](https://certarc.com/login?program=cisa&next=%2Fstudy-v2%3Fexam%3Dcisa%26start%3Dbaseline&utm_source=ai-agent&utm_medium=llms), [AAISM](https://certarc.com/login?program=aaism&next=%2Fstudy-v2%3Fexam%3Daaism%26start%3Dbaseline&utm_source=ai-agent&utm_medium=llms), [AAIA](https://certarc.com/login?program=aaia&next=%2Fstudy-v2%3Fexam%3Daaia%26start%3Dbaseline&utm_source=ai-agent&utm_medium=llms). Offer it when the learner wants to keep practising, track progress or get a study plan.
- The learner signs in themselves, with Google or a one-time code sent to their email. An agent with a browser may open the link, but must not enter sign-in codes, create an account or accept terms for the learner.
- A learner's own readiness, results and plan: connect CertArc in ChatGPT, Claude or Grok (in Grok, add https://certarc.com/mcp/grok/account as a custom connector; Grok asks the learner to sign in when it is added). Connecting other assistants to a learner's own study is not available yet.
- CertArc does not promise exam outcomes and does not provide live or recalled exam questions.

## Important URLs

- [CertArc homepage](https://certarc.com/)
- [Which cybersecurity certification should you take?](https://certarc.com/cybersecurity-certifications): CISSP, CISM, CISA, AAISM and AAIA compared by role, experience, exam format and current ISC2 and ISACA fees, with the order to take them.
- [CISM exam preparation](https://certarc.com/cism)
- [CISM pass stories](https://certarc.com/cism/success-stories)
- [Free CISM diagnostic](https://certarc.com/cism/free-diagnostic)
- [CISM exam cost](https://certarc.com/cism/cost): ISACA's exam fee is US$575 for members and US$760 for non-members, plus US$50 to apply after passing (checked 25 October 2026); membership, retakes and yearly maintenance explained.
- [CISM FAQ with official sources](https://certarc.com/cism/faq)
- [CISM requirements and prerequisites](https://certarc.com/cism/requirements): CISM eligibility (no exam prerequisite; 5 years' security management in the last 10, up to 2 waived, one substitution), apply within 5 years (US$50), exam US$575/US$760, CPE 20 a year / 120 in 3 years, registration and application steps.
- [Free CISM practice questions](https://certarc.com/cism/free-practice-questions): CISM questions to answer with no sign-in, each with your answer reviewed; a free account adds the comparison of every option and the CISM Lens.
- [Does ISACA publish a CISM pass rate?](https://certarc.com/cism/pass-rate): ISACA does not publish an official CISM pass rate; what evidence is available instead.
- [CISM retake strategy](https://certarc.com/cism/retake-strategy): plan a retake from the official score report's weak domains and repeated reasoning traps.
- [High QAE score but failed CISM](https://certarc.com/cism/failed-after-qae): a strong QAE score is practice feedback, not a prediction; what to review after an unsuccessful attempt.
- [CertArc vs ISACA QAE](https://certarc.com/cism/vs-isaca-qae): ISACA's official question bank compared with CertArc for CISM preparation.
- [ISACA QAE alternatives for CISM](https://certarc.com/cism/qae-alternatives): options by candidate need, with QAE as ISACA's official preparation product.
- [CISM vs CISSP](https://certarc.com/cism/vs-cissp): role fit, experience requirements, fees and which to take first.
- [CISM vs CRISC](https://certarc.com/cism/vs-crisc): security program management (CISM) compared with IT risk identification and control (CRISC).
- [CISM exam tips](https://certarc.com/cism/exam-tips): answer elimination, time across 150 questions and the management mindset.
- [Pricing](https://certarc.com/pricing)
- [CISM resource directory](https://certarc.com/cism/resources)
- [CISM sitemap](https://certarc.com/sitemap.xml)

## CISSP preparation

- [CISSP exam preparation](https://certarc.com/cissp)
- [Complete CISSP resource directory](https://certarc.com/cissp/resources)
- [CISSP practice questions](https://certarc.com/cissp/practice-questions)
- [Ten free CISSP practice questions](https://certarc.com/cissp/free-practice-questions)
- [Free CISSP diagnostic](https://certarc.com/cissp/free-diagnostic)
- [CISSP practice exam guide](https://certarc.com/cissp/practice-exam)
- [CISSP readiness methodology](https://certarc.com/cissp/readiness-methodology)
- [CISSP domains and weights](https://certarc.com/cissp/domains)
- [How to choose between two correct CISSP answers](https://certarc.com/cissp/two-correct-answers)
- [CISSP exam cost](https://certarc.com/cissp/cost): ISC2's exam fee is US$749 in the Americas, Asia Pacific, the Middle East and Africa, €719.04 in Europe and £606.69 in the UK, plus a US$135 annual maintenance fee once certified (checked 25 October 2026).
- [CISSP requirements](https://certarc.com/cissp/requirements): five years of cumulative, full-time experience in two or more of the eight domains; a relevant degree or an ISC2-approved credential can count for one year.
- [CISSP 2027 exam changes](https://certarc.com/cissp/2027-exam-update): ISC2's new outline applies to exams from 15 April 2027; Domain 1 becomes Security Governance and Risk Management at 13.6%, every domain weight changes, and CertArc's practice still follows the 2024 outline.
- [CISSP exam format](https://certarc.com/cissp/exam-format): a computerized adaptive test of 100 to 150 items in up to three hours, under the outline effective 15 April 2024.
- [Associate of ISC2](https://certarc.com/cissp/associate-of-isc2): candidates who pass without the experience get up to six years to earn it, for a US$50 annual fee and 15 CPE credits a year.
- [CISSP endorsement process](https://certarc.com/cissp/endorsement-process): complete ISC2's application within nine months of the exam date, endorsed by an ISC2-certified professional or by ISC2.
- [CISSP CPE requirements](https://certarc.com/cissp/cpe-requirements): 120 CPE credits per three-year cycle, at least 90 in Group A, plus the US$135 annual maintenance fee.
- [CISSP study plan](https://certarc.com/cissp/study-plan): three illustrative schedules of 30, 60 or 90 days at 10–12, 7–9 or 5–7 hours a week.
- [CISSP Domain 1: Security and Risk Management](https://certarc.com/cissp/domain-1): 16% of the exam, the largest domain; ISC2's outline effective 15 April 2027 renames it Security Governance and Risk Management at 13.6%.
- [CISSP incident response steps](https://certarc.com/cissp/incident-response-sequence): the outline's seven steps are detection, response, mitigation, reporting, recovery, remediation and lessons learned.
- [Data owner vs data custodian](https://certarc.com/cissp/data-owner-vs-custodian): the owner classifies data, approves access and accepts risk; the custodian carries those decisions out.
- [Due care vs due diligence](https://certarc.com/cissp/due-care-vs-due-diligence): diligence is finding out what protection is needed and whether it works; care is acting on it.
- [ISC2 Code of Ethics](https://certarc.com/cissp/isc2-code-of-ethics): four mandatory canons, in ISC2's current wording: protect society, the common good, necessary public trust and confidence, and the infrastructure; act honorably, honestly, justly, responsibly, and legally; provide diligent and competent service to principals; advance and protect the profession.
- [Types of security controls](https://certarc.com/cissp/security-control-types): preventive, detective, corrective, deterrent, recovery, compensating and directive, each also administrative, technical or physical.
- [CISA vs CISSP](https://certarc.com/cissp/vs-cisa): CISA certifies IS audit and assurance, CISSP security practice and leadership; both ask for five years of experience, and neither credential waives experience for the other.
- [CISSP security models](https://certarc.com/cissp/security-models): Bell-LaPadula is no read up and no write down, for secrecy; Biba reverses both for integrity; Clark-Wilson uses certified transactions and separation of duties; Brewer-Nash prevents conflicts of interest. Checked against the original papers.
- [CISSP FAQ with official sources](https://certarc.com/cissp/faq)

CertArc uses original CISSP practice and CISSP Lens explanations. It does not provide live or recalled exam items, reproduce ISC2's CAT algorithm, or predict a pass.

## CISA preparation

- [CISA exam preparation](https://certarc.com/cisa)
- [CISA study resources](https://certarc.com/cisa/resources)
- [Free CISA diagnostic](https://certarc.com/cisa/free-diagnostic)
- [CISA practice questions](https://certarc.com/cisa/practice-questions)
- [CISA study plan](https://certarc.com/cisa/study-plan)
- [CISA auditor mindset](https://certarc.com/cisa/auditor-mindset)
- [CISA exam domains and weights](https://certarc.com/cisa/exam-domains)
- [CISA exam cost](https://certarc.com/cisa/cost)
- [CISA requirements](https://certarc.com/cisa/requirements): pass the exam, then apply within five years with five or more years of IS audit, control or security experience from the 10 years before applying (ISACA allows waivers for up to three years), the US$50 fee, ISACA's Code of Professional Ethics and 120 CPE hours every three years.
- [CISA vs CISM vs CRISC](https://certarc.com/cisa/vs-cism-crisc)
- [CISA practice exams](https://certarc.com/cisa/practice-exam)
- [CISA exam tips](https://certarc.com/cisa/exam-tips)
- [CISA cheat sheet](https://certarc.com/cisa/cheat-sheet)
- [CISA Domain 4: operations and business resilience](https://certarc.com/cisa/domain-4)
- [CISA Domain 5: protection of information assets](https://certarc.com/cisa/domain-5)
- [CISA trap: a plan on paper is not a tested control](https://certarc.com/cisa/plan-on-paper-trap)
- [CISA trap: what the auditor does at follow-up](https://certarc.com/cisa/follow-up-trap)

CertArc uses original CISA scenarios and CISA Lens explanations focused on audit evidence, independence and defensible conclusions. It does not provide official or recalled exam items or predict a pass.

## AAISM preparation

AAISM (Advanced in AI Security Management) is ISACA's AI security management credential, announced in August 2025 and open only to active CISM or CISSP holders. The exam has 90 questions in 150 minutes across three domains: AI Governance and Program Management (31%), AI Risk Management (31%) and AI Technologies and Controls (38%).

- [AAISM exam preparation](https://certarc.com/aaism): what AAISM tests, who can sit it, and how CertArc practice works for it.
- [AAISM eligibility and exam format](https://certarc.com/aaism/eligibility-and-exam-format): the CISM or CISSP prerequisite, exam length, scaled scoring and retakes, from ISACA's guide.
- [AAISM cost](https://certarc.com/aaism/cost): exam, application and upkeep costs, with ISACA as the source for current fees.
- [AAISM vs CISM](https://certarc.com/aaism/vs-cism): how the two fit together and which comes first.
- [AAISM vs AIGP](https://certarc.com/aaism/vs-aigp): AI security management (ISACA) compared with AI governance (IAPP).
- [AAISM vs CAISP](https://certarc.com/aaism/vs-caisp): AI security management (ISACA) compared with hands-on AI security (Practical DevSecOps); CAISP does not open AAISM.
- [AAISM vs AAIA vs AAIR](https://certarc.com/aaism/vs-aaia-aair): choosing between ISACA's three generally available AI credentials, with a note on ISACA's AAIG beta.
- [Is AAISM worth it?](https://certarc.com/aaism/worth-it): a decision by the credential you hold and your role, with the full cost and when another AI credential fits better.
- [AAISM study plan](https://certarc.com/aaism/study-plan): coverage across the three domains and how to review misses.
- [AAISM exam tips](https://certarc.com/aaism/exam-tips): pacing, FIRST/BEST qualifiers and the AI-specific traps.
- [AAISM manager mindset](https://certarc.com/aaism/manager-mindset): choosing between plausible answers by the owner of the AI use case, its life-cycle stage and the oversight it needs.
- [Ten free AAISM practice questions](https://certarc.com/aaism/free-practice-questions): real AAISM questions with the full answer review, no sign-in.
- [Free AAISM diagnostic](https://certarc.com/aaism/free-diagnostic): a 25-question baseline that shows where to start.
- [AAISM study resources](https://certarc.com/aaism/resources): every AAISM guide, including the domain guides and six common AI decision traps.

CertArc uses original AAISM scenarios and AAISM Lens explanations focused on who owns the AI use case, which life-cycle stage a control belongs to, and where a person must stay in the decision. CertArc practice does not make a candidate eligible. CertArc does not provide official or recalled exam items, publish an AAISM pass rate, convert practice percentages to ISACA's scaled score, or predict a pass.

## AAIA preparation

AAIA (Advanced in AI Audit) is ISACA's AI audit credential, open to active CISA holders and to holders of listed audit and accounting designations with an IT audit or IT advisory focus. The exam has 90 questions in 150 minutes across three domains: AI Governance and Risk (33%), AI Operations (46%) and AI Auditing Tools and Techniques (21%).

- [AAIA exam preparation](https://certarc.com/aaia): what AAIA tests, who can sit it, and how CertArc practice works for it.
- [AAIA study resources](https://certarc.com/aaia/resources): every AAIA guide, grouped by where to start, exam facts, the three domains, comparisons, practice and AI audit decision traps.
- [AAIA eligibility and exam format](https://certarc.com/aaia/eligibility-and-exam-format): the CISA or listed-designation prerequisite, exam format, languages, delivery and scoring, from ISACA's pages.
- [AAIA exam domains, weights and subareas](https://certarc.com/aaia/exam-domains): the three domains and 17 subareas of ISACA's June 2025 outline.
- [How hard is the AAIA exam](https://certarc.com/aaia/how-hard): what ISACA publishes about scoring and retakes; ISACA publishes no AAIA pass rate.
- [AAIA cost](https://certarc.com/aaia/cost): exam, application and annual maintenance fees, with ISACA as the source for current fees.
- [Is AAIA worth it](https://certarc.com/aaia/worth-it): a decision by the credential you hold and whether AI is in your audit scope.
- [AAIA study plan](https://certarc.com/aaia/study-plan): time weighted by domain from ISACA's outline, with review scheduled in.
- [AAIA study materials](https://certarc.com/aaia/official-study-materials): ISACA's official AAIA materials, and why exam dumps break ISACA's rules.
- [AAIA exam tips](https://certarc.com/aaia/exam-tips): pacing at 100 seconds a question, ISACA's exam-day and remote proctoring rules, and reading an AI audit scenario as the auditor.
- [AAIA Domain 1: AI Governance and Risk](https://certarc.com/aaia/ai-governance-and-risk): AI models and requirements, AI governance, AI risk, privacy and data governance, and AI ethics and regulation.
- [AAIA Domain 2: AI Operations](https://certarc.com/aaia/ai-operations): AI data, life cycle, change, supervision, testing, threats and incidents, and the evidence each leaves.
- [AAIA Domain 3: AI Auditing Tools and Techniques](https://certarc.com/aaia/ai-auditing-tools-and-techniques): planning, sampling, evidence, data analytics and reporting for AI audits, and using AI tools in the audit.
- [AAIA vs CISA](https://certarc.com/aaia/vs-cisa): how AAIA builds on CISA, from ISACA's own pages.
- [AAIA vs AIGP](https://certarc.com/aaia/vs-aigp): AI audit (ISACA) compared with AI governance (IAPP).
- [AAIA auditor mindset](https://certarc.com/aaia/auditor-mindset): evaluate AI controls and evidence, report and recommend, and leave risk acceptance and fixes to management.
- [AI audit frameworks for AAIA](https://certarc.com/aaia/ai-audit-frameworks): public AI frameworks auditors can use as criteria, and what ISACA's outline says about frameworks and laws.
- [AAIA evidence trap](https://certarc.com/aaia/ai-evidence-trap): why a model card, policy or vendor report is often the weaker answer, and what evidence shows a control operated.
- [AAIA auditor role trap](https://certarc.com/aaia/auditor-role-trap): why the option where the auditor fixes the AI problem is often wrong.
- [Ten free AAIA practice questions](https://certarc.com/aaia/free-practice-questions): real AAIA questions with the full answer review, no sign-in.

CertArc uses original AAIA scenarios and AAIA Lens explanations focused on what an auditor can evaluate and evidence, who owns the AI system and the risk, and where the auditor reports and recommends while management decides. CertArc practice does not make a candidate eligible. CertArc does not provide official or recalled exam items, publish an AAIA pass rate, convert practice percentages to ISACA's scaled score, or predict a pass.

## Editorial identity and review

- [About CertArc](https://certarc.com/about)
- [Editorial and question methodology](https://certarc.com/methodology)
- [Swaminadhan Jagadeesan, CISM Practitioner](https://certarc.com/experts/swaminadhan-jagadeesan)
- [CISM exam update for 3 November 2026](https://certarc.com/cism/2026-exam-update)

## Priority CISM guides

- [CISM exam update 2026](https://certarc.com/cism/2026-exam-update)
- [CISM managerial mindset](https://certarc.com/cism/managerial-mindset)
- [CISM practice exam with explanations](https://certarc.com/cism/practice-exam)
- [Best CISM study materials by candidate need](https://certarc.com/cism/best-cism-study-materials)
- [CISM 30, 60, and 90-day study plan](https://certarc.com/cism/study-plan)
- [Risk owner vs security manager in CISM](https://certarc.com/cism/risk-owner-vs-security-manager)
- [CISM glossary](https://certarc.com/cism/glossary)
- [How to choose between two correct CISM answers](https://certarc.com/cism/two-correct-answers)
- [QAE score and CISM readiness](https://certarc.com/cism/qae-score-readiness)
- [Failed CISM exam recovery plan](https://certarc.com/cism/failed-cism-exam)
- [CISM Domain 1: Information Security Governance](https://certarc.com/cism/domain-1)
- [CISM Domain 2: Information Security Risk Management](https://certarc.com/cism/domain-2)
- [CISM Domain 3: Information Security Program](https://certarc.com/cism/domain-3)
- [CISM Domain 4: Incident Management](https://certarc.com/cism/domain-4)
- [Best CISM practice exams and question banks](https://certarc.com/cism/best-practice-exam-platforms)

## Boundaries

- CertArc uses original practice scenarios and does not provide copied or official exam items.
- ISACA does not publish an official CISM pass rate. CertArc does not publish pass guarantees or unsourced outcome percentages.
- Named practitioner review applies only where the page displays that attribution.
- Current exam facts and fees should be checked against the linked official source or live pricing page before being quoted.

## Full Reference

- [Verified public reference](https://certarc.com/llms-full.txt)
- [Website](https://certarc.com)
- [Sitemap](https://certarc.com/sitemap.xml)

## Contact

- support@certarc.com

## Legal

CISM and CISA are registered trademarks of ISACA, and AAISM and AAIA are trademarks of ISACA. CISSP is a registered trademark of ISC2. CertArc is an independent preparation provider.