AAISM study guide and review manual: what's free

There is no single free AAISM study guide that teaches the content, but there is more free material than most candidates use. ISACA gives away its candidate guide, its exam content outline and a 12-question practice quiz. It sells the AAISM Review Manual, in print and as a browser-based eBook, in four languages. And the frameworks and laws the exam's topics draw on, from NIST's AI Risk Management Framework to the EU AI Act, are free from their publishers. This guide sets out what each is, what it covers and what it does not, from ISACA's own pages and store, and says why a free PDF of the review manual is a warning sign rather than a bargain.

The short answer

ISACA's free documents: the AAISM Exam Candidate Guide (a PDF covering registration, exam day, scoring and the rules, with the outline in its appendix), the exam content outline, and a free practice quiz of 12 questions.
ISACA's book: the AAISM Official Review Manual, which ISACA calls "a comprehensive reference guide designed to help individuals prepare for the AAISM exam". It comes in print and as an eBook, in English, Spanish and Japanese, and as an eBook in Chinese.
The eBook is not a download. ISACA: "This is an electronic book designed to be accessible anytime through your browser without the need for downloads or printing."
The free sources the topics draw on: NIST's AI Risk Management Framework and its generative AI profile, OWASP's Top 10 for LLM Applications, MITRE ATLAS and the EU AI Act are all free from their publishers.
A free PDF of the review manual is not ISACA's. ISACA sells the manual and serves its eBook in a browser; ISACA's own advice is to "avoid unauthorized training materials".

What is the AAISM Review Manual?

It is ISACA's own book for the exam. ISACA's store describes it as "a comprehensive reference guide designed to help individuals prepare for the AAISM exam", and adds that "This edition is organized to supplement understanding of the essential concepts in-line with the exam", covering the three domain areas of ISACA's outline: AI Governance and Program Management, AI Risk Management, and AI Technologies and Controls.

On who wrote it, the store says: "ISACA has developed this AAISM certification training material in cooperation with its global network of experts in the field of IT security and AI." On how to use it: "This manual is an excellent stand-alone document for individual study and can be used as a guide or reference for study groups and chapters conducting local review courses."

Formats and languages. ISACA's store lists seven versions: print and eBook in English, Spanish and Japanese, and an eBook in Simplified Chinese. The English print edition carries ISBN 9798892270540, and the English eBook ISBN 9798892270533, which is a simple way to check that a copy you are offered is ISACA's.

Price. When we checked on October 25, 2026, ISACA's store data listed each version at US$105. ISACA members pay less; the candidate guide says membership brings "savings on ISACA products like certification exams, conferences and exam prep materials". Check the store for the current figure.

The eBook. "This is an electronic book designed to be accessible anytime through your browser without the need for downloads or printing." ISACA adds a warning worth taking: "Please review the FAQs to ensure you understand the requirements prior to purchase, as all sales are final." If you want to annotate a printed page, buy the print edition; the eBook will not give you one.

Is there an AAISM study guide PDF?

Yes, but it is not a content book. ISACA publishes the AAISM Exam Candidate Guide as a free PDF, and its own overview says what it is for: "It contains important details ISACA exam candidates need to know before administration of the exam, including scheduling information, exam eligibility, and exam day rules." It has four sections, an introduction, registration and scheduling, exam preparation and after the exam, and it prints the exam content outline in its appendix. ISACA's candidate-guides page links it in English, Japanese and Spanish.

What the guide does not do is teach the 13 topics. For that you need a content source: the review manual, a course, or your own reading of the frameworks below.

As for the review manual itself, ISACA does not sell it as a downloadable PDF: the eBook reads in a browser "without the need for downloads or printing". A file presented as a free AAISM review manual PDF did not come from ISACA's store. ISACA's article on exam integrity is direct about material like that: "it is essential for test-takers to avoid unauthorized training materials". Beyond the rules, such a file may be an old draft, a different exam's book or someone's notes under ISACA's title, and you cannot tell which.

What ISACA gives away free

Four things, all from ISACA's site:

The AAISM Exam Candidate Guide, version 1.26, the edition ISACA's candidate-guides page links. Read it once early, for the rules, and once in the last week, for exam day.
The AAISM exam content outline, on its own page and in the guide's appendix: three domains with their shares, 13 topics and 22 tasks. It is the closest thing to a syllabus ISACA publishes, and the best checklist you will have.
A practice quiz. ISACA's AAISM page: "Test your knowledge with these 12 free questions."
Study groups, for members. "This member-exclusive online forum acts as a global virtual study group for those preparing to take the AAISM certification exam."

ISACA's paid preparation is the review manual, the questions database ("a comprehensive 200+ question pool of items") and the online review course. None of them is required to take the exam.

The free sources the exam leans on

ISACA's outline asks candidates to use "leading practices, ethical principles, regulatory requirements, and industry frameworks", but it names no framework. The ones its topics most often point to are free from their publishers, and they are the primary sources behind any good book or course.

NIST AI 100-1, the AI Risk Management Framework (AI RMF 1.0). NIST says the framework "is intended to be voluntary, rights-preserving, non-sector-specific, and use-case agnostic". It organizes AI risk management into four functions. The NIST AI RMF for AAISM candidates reads it for the exam.
NIST AI 600-1, the generative AI profile, which applies the framework to generative AI.
OWASP's Top 10 for LLM Applications 2026, published August 4, 2026. OWASP calls it "a consensus product" of practitioners, now weighed against incident data. The OWASP LLM Top 10 for AAISM candidates goes through the ten.
MITRE ATLAS, which MITRE describes as "a public knowledge base of adversary TTPs targeting AI systems". MITRE ATLAS for AAISM candidates explains how security managers use it.
The EU AI Act, in the Official Journal, with the amending regulation published on July 24, 2026 and a consolidated text of July 27, 2026. The EU AI Act for AAISM candidates covers what a security manager needs.

These are long documents, and you do not need to read them end to end. Read each for its structure and purpose, then go deep only where the outline's tasks point: risk management for the NIST framework, application risks and their controls for OWASP, adversary techniques for ATLAS, and obligations and incidents for the Act.

How the exam asks it

An organization wants a framework to structure its program for managing the risks of all its AI systems across their life cycle, in every business unit and sector it operates in. Which of the following BEST fits that need?

A. The OWASP Top 10 for LLM Applications.
B. MITRE ATLAS.
C. The NIST AI Risk Management Framework.
D. The EU AI Act's list of prohibited practices.

Answer: C. NIST built its framework for exactly this: it "is intended to be voluntary, rights-preserving, non-sector-specific, and use-case agnostic", organized around functions that cover governance and the whole AI risk life cycle. OWASP's list (A) ranks the security risks of applications built on large language models, a valuable input but not a program structure; ATLAS (B) is "a public knowledge base of adversary TTPs targeting AI systems", the right tool for threat modeling; and the Act's prohibitions (D) are legal limits a program must respect, not a way to organize it. Knowing what each source is for is half of answering AAISM questions that name them. Written for this guide in the exam's shape; it is not an ISACA question.

Is the review manual enough on its own?

ISACA's store calls it "an excellent stand-alone document for individual study", and as a reference to the outline's content it is the most direct source there is. Two things it cannot do by itself are worth planning for.

The first is practice. A reference book explains concepts; the exam asks you to choose between options that are each partly right, 90 times, on one clock. That skill comes from questions with rationales and from at least one timed mock, which is why ISACA also sells a questions database alongside the manual.

The second is currency. AI security moves faster than any printed book: OWASP published a new edition of its Top 10 for LLM Applications on August 4, 2026, and the EU amended its AI Act by a regulation published on July 24, 2026, both after ISACA launched the AAISM in August 2025. Whatever edition you buy, read the current versions of the free sources alongside it for anything that has changed.

How to use the review manual well

If you buy the manual, it works best as one part of a plan rather than the whole of it.

Start from the outline, not page one. Read the 22 tasks first, then use the manual's chapters to fill the gaps you find, spending the most time on the domains that carry the most weight and the ones you know least.
Read actively. After each section, write two or three sentences in your own words on what a security manager would do, not just what the terms mean. The exam asks for decisions.
Pair it with questions. The manual explains; it does not rehearse the format. Questions with rationales for every option are what turn reading into the habit of choosing "one best answer".
Use it as a reference late. In the last two weeks, go back to it only for the topics your practice results show are weak.

AAISM study notes and flashcards

Searches for AAISM notes usually mean one of two things: someone else's summary, or a way to keep what you have read. Someone else's notes have the PDF problem in miniature: you cannot tell what edition, what exam or what errors they carry. Your own notes are worth more. A good format is one page per outline task: what the task asks, the controls or decisions it involves, and one example of how a question might frame it. Twenty-two pages, written by you, are a better final-week review than any download.

Flashcards do the same job for terms and lists. Our course has 2,283 of them, mapped to the outline's topics and scheduled by spaced repetition, so the cards you find hard come back sooner.

Which materials do you need?

A sound minimum, for a CISM or CISSP holder:

ISACA's free candidate guide and outline.
One structured content source: the review manual, ISACA's online course, or a course mapped to the outline.
A practice bank with rationales, and at least one timed mock.
The free frameworks above, read for purpose and structure.

ISACA's questions database is a useful addition if you want ISACA's own phrasing, and a member study group if you learn by discussion. How to study for the AAISM puts these into an 8-week plan, and AAISM training compares ISACA's courses with self-study.

Where to start

The quickest test of any material is to try it. A free account opens the first topic, AI governance and regulation, in full: its 147 questions with rationales, its lessons and its flashcards, plus a short diagnostic and a study plan. The AAISM exam guide shows every topic and lesson. Full access to all 63 lessons, 1,717 questions and 2,283 flashcards is a single payment, with nothing to renew.

By QualExam editorial. Written against the certifying body’s published documents, pinned by hash so a revised edition shows up as a change.