AAISM training: ISACA's courses and self-study

AAISM training comes in three forms: ISACA's live virtual workshop, ISACA's own self-paced materials, and independent self-study. ISACA's workshop is the most structured: two or four days of live instruction that, in ISACA's words, include the review manual, the questions database and the exam fee. Its self-paced options are an online review course, the AAISM Review Manual and a questions database you can buy separately. Self-study with a course built on ISACA's outline is the third route, and for an experienced CISM or CISSP holder it is often enough. This guide sets out each route from ISACA's own pages, what each includes, how to judge any AAISM course, and how to choose.

The short answer

• ISACA's virtual workshop is "an immersive 2-day or 4-day virtual training event", and "Enrollment includes the AAISM Review Manual (eBook edition), AAISM Questions, Answers and Explanations Database (QAE) as well as the exam cost." It must be attended live and earns up to 16 CPE hours.
• ISACA's self-paced options: an online review course "that provides on-demand instruction and in-depth exam preparation", the AAISM Review Manual in digital or print, and a questions database of more than 200 items.
• Self-study with a course mapped to ISACA's outline, practice in the exam's format and timed mocks is the third route; you pay the exam fee separately.
• The workshop is open to more people than the exam: "While the AAISM certification is exclusive to CISM and CISSP holders, this workshop is open to all security practitioners."
• No training is required. ISACA's steps to certification list the prerequisite, the exam, the fee, the application and the CPE policy; no course is among them.

Is AAISM training required?

No. The candidate guide's six steps to certification are to hold an active CISM or CISSP, pass the exam, pay the US$50 application fee, submit the application, follow ISACA's code of ethics and terms, and follow the CPE policy. None of them is a course. The guide describes preparation as your choice: "ISACA offers a variety of exam preparation resources, including group training, self-paced training, and study resources in various languages, to help you prepare for the certification exam."

What the exam does require is the knowledge in ISACA's outline: three domains, 13 topics and 22 tasks, tested by 90 questions that each ask for "one best answer". The question for training is how you will get that knowledge and the skill of applying it, not whether ISACA will check that you took a class.

ISACA's AAISM virtual workshop

ISACA calls its live training Unlocking AAISM, and its page describes "an immersive 2-day or 4-day virtual training event" on the AAISM's topics. In ISACA's words, the course "builds upon existing security management best practices and focuses on the associated threat landscape".

What is included. "Enrollment includes the AAISM Review Manual (eBook edition), AAISM Questions, Answers and Explanations Database (QAE) as well as the exam cost." The page sums it up as "Registration fee + review manual + QAE + Exam", so the workshop price covers the exam registration as well as the training.

How long it runs. Two formats: two days of eight hours, or four days of four hours. The page gives the session times in Chicago, London and Riyadh time, so check how they fall in your own time zone before you choose.

CPE. "Each AAISM workshop qualifies for up to 16 hours of CPE credit." The hours are earned only live: "This workshop must be attended live to earn CPE credit." For a CISM holder who needs CPE anyway, that is part of the value.

Dates. When we checked on October 25, 2026, ISACA's page listed two 2-day sessions, on November 4 and 5 and on December 7 and 8, 2026. Sessions come and go, so check ISACA's page for the current ones.

Who it is for. Unlike the exam, the workshop has no prerequisite. ISACA's page: "While the AAISM certification is exclusive to CISM and CISSP holders, this workshop is open to all security practitioners." A team lead without a CISM or CISSP can take the training even though the credential is not yet open to them.

ISACA's self-paced AAISM materials

ISACA's AAISM page lists its own preparation products under "Getting ready for the exam".

• AAISM Online Review Course. "Prepare for the AAISM certification exam with this online course that provides on-demand instruction and in-depth exam preparation."
• AAISM Review Manual. Sold in two versions, digital and print. ISACA calls it "A comprehensive reference guide to prepare for the AAISM certification exam."
• AAISM Questions, Answers & Explanations Database. "Get a six-month subscription to a comprehensive 200+ question pool of items. Build a custom study plan with a personalized dashboard, track progress and review previously answered questions."
• AAISM Study Groups, for members: "This member-exclusive online forum acts as a global virtual study group for those preparing to take the AAISM certification exam."
• A free practice quiz: "Test your knowledge with these 12 free questions."

One detail to check before you buy: ISACA's 2025 launch announcement said the online review course and the questions database "both of which allow one year of access", while ISACA's AAISM page today describes the database as six months. Access periods can change, so confirm on ISACA's store what you are buying.

What AAISM training costs

ISACA's store shows its prices only in a browser, so we do not repeat them here, but the structure of the cost is clear from ISACA's pages. The one fixed cost is the exam: "ISACA Member: US$459" and "ISACA Nonmember: US$599", paid in full for each attempt. Everything else depends on the route.

• The workshop bundles the exam fee with the review manual, the questions database and the live training, so its price is the whole bill for most candidates.
• ISACA's self-paced route is bought item by item: the online review course, the review manual and the questions database, each with its own price, plus the exam fee.
• Self-study is your course of choice plus the exam fee, with ISACA's free candidate guide, its free outline and its free 12-question quiz alongside.

Membership changes more than the exam fee: the guide says it brings "savings on ISACA products like certification exams, conferences and exam prep materials", so price both ways before you decide. If your employer pays for training, the workshop's single invoice and its 16 CPE hours are often the easier case to make. What the AAISM costs lists every ISACA fee, from the exam to the annual maintenance fee.

Training from India, Singapore and elsewhere

ISACA's virtual workshop is online, so it can be joined from anywhere, but its sessions run on a North American working day. The page lists the times in Chicago, London and Riyadh time, which puts them in the evening and night across South and Southeast Asia; the four-day format's four-hour sessions may be easier to fit than two eight-hour days. Check the times in your own zone before you register, since the workshop "must be attended live to earn CPE credit".

The exam itself has one rule that matters for some regions. ISACA's AAISM page says that for residents of India, mainland China and Hong Kong, "The AAISM exam is exclusively available at testing centers." Training can be online wherever you are, but if you live in one of those three, plan your exam day around a PSI test center.

Training partners and chapters

ISACA is not the only source of AAISM instruction. Its article on exam integrity says that "ISACA has chapter training and authorized trainers that use authorized materials for your training purposes", and ISACA's site lists certification training partners by region. Chapter courses can be a good middle path: live instruction, often in your time zone, from people who know the local market.

The same article warns about the other kind of training material: "When preparing to take any high-stakes exam, it is essential for test-takers to avoid unauthorized training materials and outside offers for someone to take the exam on their behalf." A course that promises questions from the real exam, or promises that you will pass, is the kind ISACA means.

Self-study: when a course of your own is enough

Every AAISM candidate already holds a CISM or CISSP, so every candidate has passed a demanding security exam before and knows how they study best. For many, the most efficient route is self-study: a structured course mapped to ISACA's outline, practice in the exam's format, and timed mocks, at their own pace.

Self-study suits you if you can keep a schedule without a class, if you learn better by doing questions than by listening, and if the AI side of the outline is new but the security management side is not. It suits you less if you need a fixed date to make you start, or if your employer will pay for a workshop that also covers the exam fee.

Our AAISM course is built for this route: 63 lessons mapped to ISACA's three domains and 13 topics, 1,717 practice questions in the exam's one-best-answer format, each with a rationale for every option, 2,283 flashcards with spaced repetition, a timed mock of 90 questions on one 150-minute clock, and a study plan that lays out the weeks from your exam date. Its prices are on the pricing page.

How to judge any AAISM training course

Whichever you consider, ISACA's or anyone else's, check it against ISACA's own documents.

1. Is it mapped to ISACA's outline? The AAISM has three domains, at 31%, 31% and 38%, with 13 topics and 22 tasks. A course should cover all of them, in proportion.
2. Does it practice the format? Four options and "one best answer", with qualifiers such as MOST or BEST. Knowing the material is half of the preparation; choosing between options that are each partly right is the other half.
3. Does it explain every answer? A rationale for why each wrong option falls short teaches more than the right answer alone.
4. Does it include a timed mock? 90 questions on a single 150-minute clock, the way ISACA's guide describes the exam.
5. Is it current? AI security moves fast. OWASP published a 2026 edition of its Top 10 for LLM Applications in August 2026, and the EU amended its AI Act in July 2026. Ask how a course keeps up.
6. Is it honest? No promise that you will pass, no claim to hold questions from the real exam, and no invented pass rates; ISACA publishes none.

How to choose

• Your employer pays and you want a deadline: ISACA's workshop. It bundles the manual, the questions database and the exam, and earns up to 16 CPE hours.
• You want ISACA's own materials at your own pace: the online review course, the review manual and the questions database.
• You study well alone and prefer your own pace: self-study with a course mapped to ISACA's outline, plus ISACA's free 12-question quiz and its free candidate guide.
• You are short of time: whichever route you take, spend the most hours on the domain you know least, and sit at least one timed mock.

How to study for the AAISM turns any of these into an 8-week plan.

Where to start

You can test the self-study route before paying for anything. A free account opens the first topic, AI governance and regulation, in full: its 147 questions with rationales, its lessons and its flashcards, plus a short diagnostic and a study plan. AAISM practice exam explains how to use ISACA's free quiz and a full mock, and the AAISM exam guide shows every topic. Full access is a single payment, with nothing to renew.