AAISM certification requirements

The AAISM has one prerequisite, and everything else follows from it: you must hold an active CISM or an active CISSP. With that, you register for the exam, take it within six months, pass it, and apply for certification within five years, paying a US$50 application fee. Once certified, you keep it by earning 10 continuing professional education (CPE) hours a year, paying a small annual fee, and keeping the CISM or CISSP you qualified with active. This guide takes each requirement in ISACA's own order, from its candidate guide, its AAISM pages and its CPE policy, and answers the questions candidates ask most: whether you can take the AAISM without a CISM, whether there is an experience requirement, and what happens if your CISSP lapses.

The short answer

• Prerequisite: an active CISM or CISSP. The guide's first step is "Have an active CISM or CISSP (ISC2)."
• No separate experience check. The AAISM's own steps list no work experience; the experience is built into the CISM or CISSP you must already hold.
• The exam: register and pay in full (US$459 for ISACA members, US$599 for nonmembers), then take it within six months, and pass with 450 or more.
• The application: a US$50 fee, and "Candidates have five years from passing the exam to apply for AAISM certification."
• Keeping it: 10 CPE hours a year and 30 over three years, all mapped to the AAISM's outline; an annual fee of US$20 for members or US$35 for nonmembers; and proof that your CISM or CISSP is still active.
• Breaking the rules costs the credential: "Failure to comply with these certification requirements will result in revocation of an individual's AAISM designation."

What are the AAISM prerequisites?

One, with two ways to meet it. ISACA's AAISM page says: "AAISM candidates must hold an active CISM or CISSP certification." The candidate guide lists the same as the first of its steps to certification: "Have an active CISM or CISSP (ISC2)." The CISM is ISACA's Certified Information Security Manager; the CISSP is ISC2's Certified Information Systems Security Professional. ISACA's documents name no other credential that qualifies.

"Active" matters, and so does timing. ISACA checks eligibility when you register: "Eligibility is established at the time of exam registration and is good for six months." So the CISM or CISSP has to be current on the day you register, not merely held at some point in the past. ISACA launched the AAISM for exactly this audience. Its announcement says that "Security professionals who hold a Certified Information Security Manager (CISM) or Certified Information Systems Security Professional (CISSP) are eligible to pursue the AAISM", because the credential "builds upon existing security management best practices found in CISM and CISSP".

Can I take the AAISM without a CISM?

Yes, if you hold an active CISSP instead. The two are equal routes in: the guide writes the prerequisite as "an active CISM or CISSP", and ISACA's maintenance page later asks for proof of "their active CISM or CISSP certification" without preferring either.

Without either one, no. ISACA's pages offer no waiver, no alternative credential and no experience route in place of the prerequisite. If you hold neither, the first decision is which of the two to earn, and that is a decision about your career more than about the AAISM: the CISM is ISACA's security management credential, while ISC2 says the CISSP "is ideal for experienced security practitioners, managers and executives". Either one opens the AAISM, and AAISM vs CISM and CISSP compares the two routes.

Is there an experience requirement for the AAISM?

Not one of its own. The guide's six steps to certification are the prerequisite, the exam, the fee, the application, ISACA's ethics and rules, and the CPE policy; none asks you to prove work experience for the AAISM itself. ISACA's AAISM page does describe who will benefit, which it lists as active CISM or CISSP holders, people with proven experience in security or advisory roles, and those with some expertise assessing, implementing and maintaining AI systems, but that is a description of the audience, not a rule.

The experience is there anyway, inside the prerequisite. To become a CISM, ISACA's CISM page includes the step "Submit application to demonstrate experience requirements". ISC2's CISSP page lists "5 Years Required Work Experience". Anyone who holds either has already shown security experience to get it, which is why the AAISM does not ask again.

AAISM exam requirements: registering and taking the exam

Before you can book an appointment:

• Pay the full fee. "It is important to note that the exam registration fee must be paid in full before an exam candidate can schedule and take an exam." The fee is US$459 for ISACA members and US$599 for nonmembers, and it is set by your membership status when you register.
• Mind the six months. "Upon registration, AAISM exam candidates have a six-month eligibility period to take their exam." If you need more time, the guide says "you can purchase a six-month exam extension for US$75"; otherwise the fee is forfeited when the six months run out. What the AAISM costs covers every fee.
• Book in the window. "Candidates can schedule a testing appointment as early as 48 hours after payment of exam registration fees", and "AAISM exam appointments are only available 90 days in advance."
• Choose where to test. At a PSI test center or remotely proctored, except for residents of India, mainland China and Hong Kong, for whom "The AAISM exam is exclusively available at testing centers."

On the day itself, you need a "current, valid, and original government-issued ID" whose name matches your registration, and the exam rules apply wherever you test. The AAISM exam format sets out the ID rules, the remote check-in and the break, and AAISM exam dates walks through booking.

How to apply for AAISM certification after you pass

Passing is step two of six. The guide's full list, in order:

1. "Have an active CISM or CISSP (ISC2)."
2. "Pass the AAISM exam."
3. "Pay the US$50 application processing fee."
4. "Submit the application for certification."
5. "Adhere to ISACA's Code of Professional Ethics, Terms of Use, and Privacy Policy."
6. "Adhere to the AAISM Continuing Professional Education (CPE) Policy."

The application has a deadline, but a generous one: "Candidates have five years from passing the exam to apply for AAISM certification." You cannot use those five years to take the exam again, though; the guide says that "Individuals who pass the exam are restricted from taking the same exam within the application time period of five years." In practice there is no reason to wait: you are not AAISM certified until the application is accepted, and the passing score alone is not the credential.

AAISM CPE requirements

Once certified, you keep the AAISM by continuing to learn. ISACA's maintenance page sets the numbers: "Maintaining your AAISM™ requires earning a minimum of 10 CPEs annually and a total of 30 CPEs over a 3-year period." ISACA's CPE policy adds the rules for its Advanced certifications, the AAISM among them.

• Every hour must fit the AAISM. The 10 annual hours "must be appropriate for the currency or advancement of the profession and map to the respective ISACA Advanced certification ECO", the exam content outline, and over three years "All 30 CPE hours must align with the ECO of the certification being renewed."
• Hours can count twice, within ISACA's Advanced family. "The use of these hours for meeting the CPE requirements for multiple ISACA Advanced certifications is permissible when the professional activity appropriately maps to each ECO." ISACA's maintenance page says the same of hours that serve several ISACA certifications when the activity applies to each.
• Some activities do not count. The policy says that "Mentoring activities for advanced certifications do not qualify, as those require that all CPE hours align with an ECO."
• Your first year is free of reporting. "For newly certified professionals, the annual and three-year reporting period begins on January 1 of the year succeeding certification. Reporting CPE hours attained during the year of certification is not required."
• The deadline is the end of the year. "To retain certification, payment and reporting of CPE hours are due by December 31."
• Keep your records. If you are selected for ISACA's annual audit, you must show documentation for what you reported, so keep certificates and attendance records.

ISACA's maintenance page lists where hours come from, including its conferences, webinars and online training, on-demand courses and volunteering. Ten hours a year is a light load next to ISACA's other certifications, such as the CISM, whose annual minimum under the same policy is 20 hours.

Keeping your CISM or CISSP active

The prerequisite does not end when you pass. ISACA's maintenance page says: "Maintenance requires that AAISM-certified professionals submit proof of their active CISM or CISSP certification." The CPE policy is precise about who has to send what: "Submit evidence of the maintenance of one of the approved prerequisite certifications. If you used an ISACA certification as your prerequisite certification, no evidence is required."

So the route you came in by decides the paperwork. If you qualified with a CISM, ISACA already holds the record and asks for nothing more. If you qualified with a CISSP, you send evidence that it is still active. Either way, if the CISM or CISSP lapses, so does a condition of the AAISM.

The annual maintenance fee

"The cost of the annual maintenance fee is US$20 for ISACA members, US$35 for non-members." It is due each year, and ISACA's maintenance page notes one saving for holders of more than one: "Regardless of how many ISACA Advanced certifications you hold your total annual maintenance for all of your Advanced certifications will be $20/35." A CISM has its own annual fee and CPE hours on top, under the same policy, and a CISSP is maintained under ISC2's rules.

Do you need to be an ISACA member?

No. Membership changes what you pay, not whether you may take the exam or hold the credential. The guide says that "Exam registration fees are based on membership status at the time of exam registration": US$459 for members and US$599 for nonmembers, a difference of US$140. The annual maintenance fee differs the same way, US$20 against US$35. Whether membership pays for itself depends on what else you would use it for, and on its own price, which ISACA sets separately; for a CISM holder who is already a member, the AAISM simply costs the member rate.

What happens if you do not meet the requirements

The credential is withdrawn. The maintenance page: "Failure to comply with these certification requirements will result in revocation of an individual's AAISM designation." The CPE policy adds what follows a revocation: "as all printed and digital certificates are owned by ISACA, if revoked, the certificate must be destroyed immediately."

The same policy has one more rule worth knowing before you print anything: "Individual use of an ISACA certification logo (on items such as business cards, websites, marketing or promotional materials) is not permitted". What you may use is the acronym after your name.

A checklist, from prerequisite to renewal

1. Confirm your CISM or CISSP is active today.
2. Register and pay the exam fee in full; the six months start now.
3. Book an appointment 48 hours to 90 days ahead, at a PSI test center or remotely.
4. Take the exam with a valid government-issued ID, and pass with 450 or more.
5. Pay the US$50 fee and submit your application, within five years of passing.
6. From January 1 of the next year, earn and report 10 CPE hours a year mapped to the AAISM's outline, 30 over three years.
7. Pay the annual maintenance fee, and keep your CISM or CISSP active, sending evidence each year if it is a CISSP.

Where to start

The requirement you control most is passing the exam. A free account opens the first topic, AI governance and regulation, in full: its 147 questions with rationales, its lessons and its flashcards, plus a short diagnostic and a study plan. How to study for the AAISM lays out the hours by domain, and how hard the AAISM exam is explains what to expect. When you are ready for the rest, full access to all 63 lessons and 1,717 questions is a single payment, with nothing to renew.