Full access from US$39 for 30 days, one payment, nothing renews, and a full refund within 14 days. AI governance and regulation is free to every account.
See AAISM pricingStudy plan
A study plan for your date.
The AAISM’s course week by week to your exam date, with the hours it takes.
By email, with no account needed.
Everything the AAISM tests, in one place
63
Lessons
1,717
Practice questions
2,283
Flashcards
Full length
Timed mock exams
Blueprint
What the AAISM covers.
IT security professionals who hold a CISM or CISSP and secure enterprise AI solutions, or use AI to improve security operations.
ISACA publishes the blueprint below. The domain shares are ISACA’s own; the area percentages split each domain’s share as evenly as whole numbers allow — not separate hurdles, since scoring is based on the total number of questions answered correctly. Every lesson sits under its area and reads in the app.
1. AI Governance and Program Management
31% of the exam
AI governance and regulation
5 lessons · free to every account
7%of the exam
- The AI Security Management Landscape
- Stakeholders, Accountability, and the AI Governance Charter
- Industry Frameworks: NIST AI RMF and ISO/IEC 42001
- Global AI Regulation: The EU AI Act and Beyond
- Privacy Law, Sector Rules, and the Compliance Register
AI strategies, policies and procedures
4 lessons
6%of the exam
- From Business Strategy to AI Security Strategy
- The AI Policy Stack
- Acceptable Use and Responsible AI Procedures
- Standards, Baselines, and the Policy Life Cycle
AI asset and data life cycle management
4 lessons
6%of the exam
- Inventorying AI Assets: Models, Data, and Pipelines
- Classifying AI Assets and Tiering AI Systems
- The AI Data Life Cycle
- Managing Model and Data Life-Cycle Risk
AI security program management
5 lessons
6%of the exam
- Building the AI Security Program
- Operating Model, Roles, and Skills
- AI Security Awareness and Training
- Metrics, KPIs/KRIs, and Board Reporting
- Program Assurance, Audit, and Continuous Improvement
Business continuity and incident response
4 lessons
6%of the exam
- AI Security Incidents Are Different
- AI Incident Response Playbooks
- Investigation, Documentation, and Reporting Obligations
- Business Continuity and DR for AI Systems
2. AI Risk and Opportunity Management
31% of the exam
AI risk assessment and treatment
6 lessons
11%of the exam
- The AI Risk Management Life Cycle
- Identifying and Analyzing AI Risk
- AI Impact Assessments
- Risk Appetite, Tolerance, and Thresholds
- Treating AI Risk
- Continuous Monitoring and Risk Reassessment
AI threat and vulnerability management
6 lessons
10%of the exam
- The AI Threat Landscape
- Adversarial Attacks on Models
- GenAI and LLM Threats: The OWASP LLM Top 10
- AI Vulnerability Management
- Testing AI: Red Teaming and Adversarial Evaluation
- AI Threat Intelligence and Emerging Threats
AI vendor and supply chain management
5 lessons
10%of the exam
- The AI Supply Chain and Its Risks
- Vendor Due Diligence for AI
- Contracting for AI Security
- Open-Source Models and Third-Party Components
- Ongoing Vendor Monitoring and Fourth-Party Risk
3. AI Technologies and Controls
38% of the exam
AI security architecture and design
5 lessons
8%of the exam
- Security Architecture for AI Systems
- Secure-by-Design Patterns for AI
- Identity, Access, and Zero Trust for AI
- Integrating AI into Enterprise Architecture
- Architecting RAG and Agentic Systems Securely
AI life cycle
5 lessons
8%of the exam
- Securing the AI Development Life Cycle
- Model Selection and Sourcing Decisions
- Secure Training and Fine-Tuning
- Validation, Evaluation, and Pre-Deployment Gates
- Deployment, Drift, and Model Maintenance
Data management controls
4 lessons
8%of the exam
- Data Governance for AI Security
- Protecting Data Across the AI Pipeline
- Privacy-Preserving AI Techniques
- Data Access, Retention, and Disposal for AI
Privacy, ethical, trust and safety controls
5 lessons
7%of the exam
- Operationalizing Responsible AI
- Bias and Fairness Controls
- Transparency, Explainability, and Disclosure
- Human Oversight of AI Inputs and Outputs
- Trust, Safety, and Content Controls
Security controls and monitoring
5 lessons
7%of the exam
- The AI Control Stack
- Guardrails and Runtime Protection
- Monitoring, Logging, and AI Observability
- The AI Security Tooling Landscape
- Control Assurance and Effectiveness Review
AI governance and regulation is free in full with a free account.
Practice
Practice in the app.
Every question comes with a rationale, and a free account opens AI governance and regulation in full.
- 1,717 questions in the exam’s format, written to the blueprint across its 13 content areas
- A rationale for every answer
- A timed mock in the exam’s own format: 90 questions in 150 minutes
- AI governance and regulation free in full with a free account: 147 questions with your progress kept, plus the diagnostic and your study plan
See what the questions look like
Create a free accountInside the app
Everything the exam tests, and nothing it does not.
No videos to sit through and no cohort to keep up with: just the practice and the feedback the exam rewards. This is what it looks like.
Lessons mapped to the blueprint.
Always know what a lesson is worth
- Each lesson sits under one content area of the published blueprint
- Every lesson names its area’s weight in the blueprint
- Every lesson lists its key takeaways
Flashcards for the terms and figures.
Turn repetition into recall
- The terms and figures of each lesson, one card at a time
- In the app, spaced repetition brings a card back just before you would forget it
A plan, mock exams, and readiness you can read.
Paced to your exam date
- A plan from your exam date that re-ranks as you answer
- Timed mock exams with the exam’s own question count and time limit
- Readiness is each area’s weight times your accuracy in it, summed
Progress
AAISM · exam in 9 weeks
Readiness
By area
- AI governance and regulation82%
- AI strategies, policies and procedures74%
- AI asset and data life cycle management61%
- AI security program management48%
- Business continuity and incident response69%
- AI risk assessment and treatment77%
+7 more
Weakest area
AI security program management — 6% of the exam. Review its lessons, then a set of questions.
Mock exams
+13 since the last mock
Format
Format and logistics.
Taken from ISACA’s published documents, pinned by hash so a revised edition shows up as a change.
- Questions
- 90
- Scored questions
- Not published. Some of the 90 are unscored pretest questions, and ISACA does not say how many.
- Duration
- 150 minutes
- Delivery
- Computer-based, at a PSI test center or remotely proctored
- Passing score
- 450 on a scaled range of 200–800
- Open book
- No
- Retakes
- Four attempts in a rolling 12 months: the first retake at least 30 days after the first attempt, each of the next two at least 90 days after the attempt before it, at the full registration fee each time.
- Fees
- US$459 (ISACA member) · US$599 (nonmember)
- Jurisdiction
- Worldwide
How the AAISM runs
- One break of up to 10 minutes is allowed, with the proctor’s permission. The exam is paused, but the timer does not stop, so the break comes out of the 150 minutes.
- Every question has a stem and four options, with one best answer. A question may turn on a qualifier, such as MOST likely or BEST. A wrong answer costs nothing, so no question should be left blank.
- Results come on a scale from 200 to 800, where 450 or higher passes and 800 means every question answered correctly. Results by domain are for information only: the score rests on the total number of questions answered correctly.
- ISACA gives each domain a share of the exam, 31%, 31% and 38%, and none to the topics within it. The weights on this page split each domain’s share between its topics as evenly as whole numbers allow.
Questions
AAISM questions, answered.
Each answer names the document it comes from.
What is the AAISM, and who is it for?
The AAISM (Advanced in AI Security Management) is ISACA’s certification for IT security professionals who hold a CISM or CISSP and are, in ISACA’s words, “looking to gain recognition for their expertise in securing enterprise AI solutions and leveraging AI to improve security operations”. Candidates must hold an active CISM or CISSP.
Source: ISACA AAISM Exam Candidate Guide v1.26, page 5; ISACA AAISM certification page
How is the AAISM exam structured?
90 multiple-choice questions in 2.5 hours (150 minutes), taken on a computer at a PSI test center or remotely proctored. Every question has a stem, which may be a question or an incomplete statement, and four options, and every question is designed with one best answer.
Source: ISACA AAISM Exam Candidate Guide v1.26, pages 5, 6 and 10
What does a qualifier such as MOST or BEST mean in an AAISM question?
ISACA’s guide tells candidates to read each question carefully, because a question may require choosing the answer based on a qualifier, such as MOST likely or BEST. You choose the correct or best answer from the four options; the guide’s advice is to eliminate the answers you know are wrong and then make the best choice possible.
Source: ISACA AAISM Exam Candidate Guide v1.26, page 10
Is there a break during the AAISM exam?
One break of no longer than 10 minutes is permitted, with your proctor’s permission. The exam is paused during an approved break, but the timer does not stop, and no extra time is given, so the break comes out of your 150 minutes.
Source: ISACA AAISM Exam Candidate Guide v1.26, pages 13 and 14
How is the AAISM scored, and what is the passing score?
ISACA reports a scaled score from 200 to 800, a conversion of your raw score to a common scale so that different versions of the exam are comparable. A score of 450 or higher passes, and 800 means every question answered correctly. Scores rest on the total number of questions answered correctly, whatever the domain, and there are no penalties for incorrect answers, so no question should be left blank. The domain results in your report are for information only.
Source: ISACA AAISM Exam Candidate Guide v1.26, pages 10 and 17
Are all 90 AAISM questions scored?
No. ISACA exams contain scored items as well as pretest items, and pretest items are not used to calculate exam scores. The guide does not say how many of the 90 are pretest items.
Source: ISACA AAISM Exam Candidate Guide v1.26, page 17
When do I get my AAISM result?
A preliminary pass status appears on screen as soon as you finish. The official score is emailed and posted online within 10 working days, with details on applying for certification if you passed; question-level results are not provided. If you do not pass, you can ask in writing for a rescore within 30 days of the results’ release, for a fee of US$75.
Source: ISACA AAISM Exam Candidate Guide v1.26, pages 17 and 18
How many times can I take the AAISM exam?
Four attempts within a rolling 12 months. After a first attempt that does not pass, you wait 30 days for the second, then 90 days after the second for the third and 90 days after the third for the fourth, paying the full registration fee each time. Once you pass, you cannot take the same exam again during the five years you have to apply.
Source: ISACA AAISM Exam Candidate Guide v1.26, page 18
How much does the AAISM exam cost, and how long do I have to take it?
US$459 for ISACA members and US$599 for nonmembers, nonrefundable and nontransferable. Registering opens a six-month eligibility period, and one six-month extension can be bought for US$75. Appointments can be booked from 48 hours after payment and up to 90 days ahead, and moved without penalty up to 48 hours before.
Source: ISACA AAISM Exam Candidate Guide v1.26, pages 5, 6, 8 and 9
Can I take the AAISM exam at home?
In most places, yes: the exam is given at PSI test centers or remotely proctored, closed book either way. Residents of India, mainland China and Hong Kong can take it only at a test center. At home you complete a room scan before the exam begins, and you can talk to the proctor only in English, by live chat.
Source: ISACA AAISM Exam Candidate Guide v1.26, pages 6, 12, 15 and 16; ISACA AAISM certification page
In which languages is the AAISM exam offered?
English, Spanish and Japanese. To change your exam language you reschedule your testing appointment, at least 48 hours before it. QualExam’s AAISM lessons, questions and mock exam are in English.
Source: ISACA AAISM Exam Candidate Guide v1.26, pages 5 and 8
What do I need to become AAISM certified after passing?
An active CISM or CISSP, a passing score, the US$50 application processing fee and an application, and adherence to ISACA’s Code of Professional Ethics and the AAISM CPE policy. You have five years from passing the exam to apply.
Source: ISACA AAISM Exam Candidate Guide v1.26, page 19; ISACA AAISM certification page
How do I keep the AAISM once I have it?
Earn and report at least 10 CPE hours a year and 30 over three years, pay the annual maintenance fee (US$20 for ISACA members and US$35 for nonmembers, one fee however many ISACA Advanced certifications you hold), and show proof of an active CISM or CISSP.
Source: ISACA Maintain AAISM Certification page
What are the AAISM’s 22 tasks?
ISACA’s exam content outline has three domains and 13 topics, and lists 22 tasks apart from them as “Secondary Classifications”, from collaborating on the charter, roles and responsibilities for the governance and management of AI to advising on security risk and controls related to the AI solution development life cycle. The tasks are not tied to topics, and the outline gives the domains their shares of the exam and the tasks none. QualExam’s lessons follow the 13 topics.
Source: ISACA AAISM Exam Candidate Guide v1.26, pages 20 and 21
What does QualExam offer for the AAISM, and what doesn’t it?
Lessons mapped to the exam content outline’s 13 topics, practice questions in the exam’s format of four options with one best answer, flashcards, and a timed mock exam of 90 questions on one 150-minute clock that draws each domain at its share. Every question here is original; none is AAISM exam content, which ISACA’s Terms of Use forbid candidates to copy, recreate or share. QualExam is an independent study resource, not one of ISACA’s Accredited Training Organizations, and is not affiliated with, endorsed by, or sponsored by ISACA.
Source: ISACA AAISM Exam Candidate Guide v1.26, pages 5, 10, 13 and 20
Articles
Articles.
- Oct 24, 2026
AAISM exam format, scoring and passing score
90 questions in 150 minutes, four options and one best answer, a break that doesn't stop the clock, and a 200 to 800 scale where 450 passes.
Read the article - Oct 24, 2026
AAISM exam cost: every fee, from exam to CPE
US$459 for ISACA members or US$599 for nonmembers, then a US$50 application fee and a yearly fee; extensions, rescores and retakes cost extra.
Read the article - Oct 24, 2026
AAISM exam questions: what they look like
The AAISM's question format in ISACA's words, four original questions with rationales, why dumps break ISACA's rules, and where to practice.
Read the article
Sources
Where this comes from.
Every figure above is taken from the documents below, pinned by hash so a revised edition shows up as a change. Where ISACA’s own sources disagree with each other, the controlled document wins and the disagreement is recorded.
- ISACA AAISM Exam Candidate Guide v1.26Version 1.26, with the AAISM Examination Content Outline of June 2025
- ISACA AAISM certification pageWeb page, retrieved October 24, 2026
- ISACA Maintain AAISM Certification pageWeb page, retrieved October 24, 2026
The AAISM™ is a certification of ISACA®. QualExam is an independent study resource, not one of ISACA’s Accredited Training Organizations, and is not affiliated with, endorsed by, or sponsored by ISACA. Every question here is original; none is AAISM exam content.
By QualExam editorial. Written against the certifying body’s published documents, pinned by hash so a revised edition shows up as a change.
Source: ISACA AAISM Exam Candidate Guide v1.26
Last checked against the source: October 24, 2026
A full refund within 14 days.
No reason needed.
If paid access is not working for you, write to us within 14 days of the payment and we refund it in full, to the way you paid.
