AAISM vs CISM and CISSP: which comes first

The AAISM is not an alternative to the CISM or the CISSP; it is built on top of one of them. ISACA will not let you take the AAISM unless you already hold an active CISM or CISSP, so for most people the real question is which of those two to earn first, and then whether to add the AAISM. This guide compares the three from ISACA's and ISC2's own pages: what each certifies, who may take it, how each exam is built, how each is maintained and recognized, and which order makes sense for your career.

The short answer

• The AAISM requires one of the other two. "AAISM candidates must hold an active CISM or CISSP certification."
• The CISM certifies security management. ISACA's guide says it is "Designed for those who manage, design, oversee, and assess an enterprise's information security function".
• The CISSP certifies information security more broadly. ISC2 says it proves "you have what it takes to effectively design, implement and manage a best-in-class cybersecurity program."
• The AAISM adds AI to either. In ISACA's words, it "builds upon existing security management best practices found in CISM and CISSP and focuses on the associated threat landscape".
• If you hold neither: choose the CISM if you manage security programs, the CISSP if you design and implement security as well, then add the AAISM.
• If you hold one: that one is your route in; ISACA treats them equally.

AAISM vs CISM vs CISSP at a glance

Is the AAISM a replacement for the CISM or CISSP?

No. It cannot be, because you need one of them to take it. ISACA's candidate guide puts the prerequisite first among its steps to certification: "Have an active CISM or CISSP (ISC2)." And the AAISM keeps depending on it after you pass: "Maintenance requires that AAISM-certified professionals submit proof of their active CISM or CISSP certification."

ISACA's own blog put the relationship plainly in October 2025: "Both CISSP and CISM are accepted qualifying credentials for ISACA's new Advanced in AI Security Management (AAISM) certification". It went on: "the certifications aren't meant to rival each other. They're steppingstones that expand your perspective as the profession evolves." The AAISM is a specialization for a security professional who already has the foundation, in the area where that foundation now has to stretch: AI.

AAISM vs CISM

The CISM is ISACA's security management credential, and the AAISM is the closest thing to an AI extension of it. ISACA's blog lists among its resources a piece titled "Why AAISM is the Next Step for CISMs", describing the AAISM as "a natural next step to layer AI expertise for those who hold the CISM credential."

What each covers. The CISM's outline in ISACA's 2026 guide has four domains: Information Security Governance (17%), Information Security Risk Management (20%), Information Security Program (33%) and Incident Management (30%). The AAISM's three domains carry the same disciplines into AI: AI Governance and Program Management (31%), AI Risk and Opportunity Management (31%) and AI Technologies and Controls (38%). The pattern is familiar to a CISM: governance, risk, a program, incidents. What is new is the subject, from the AI life cycle to AI-specific threats and controls.

Who may take each. The CISM asks for "Five (5) or more years of experience in information security management", with "Experience waivers are available for a maximum of two (2) years." The AAISM asks for no experience of its own, because the CISM or CISSP you hold already proves it.

The exams. The CISM is the longer exam: "4 hours (240 minutes), 150 multiple-choice questions". The AAISM's is "2.5 hours (150 minutes); 90 multiple-choice questions". Both are scored "on a common scale from 200 to 800", and 450 passes both.

A date to know. ISACA's CISM page says: "Please be advised that the CISM Exam Content Outline will be updated effective 3 November 2026." If you are preparing for the CISM now, check which outline your exam date falls under.

AAISM vs CISSP

The CISSP is ISC2's flagship credential and the broader of the two prerequisites. ISC2 says the CISSP "is ideal for experienced security practitioners, managers and executives", and its exam covers eight domains, from security and risk management to software development security.

Who may take each. ISC2's CISSP page lists "5 Years Required Work Experience". Its exam outline page adds a route for those without it: "A candidate that doesn't have the required experience to become a CISSP may become an Associate of ISC2 by successfully passing the CISSP examination. The Associate of ISC2 will then have six years to earn the five years required experience." An Associate of ISC2 is not yet a CISSP, and ISACA asks for an active CISSP, so the AAISM waits until the experience is earned.

The exams. The CISSP is a different kind of exam. ISC2: "The CISSP exam uses Computerized Adaptive Testing (CAT) for all exams." The outline page gives a length of 3 hours, 100 to 150 items, "Multiple choice and advanced item types" and a passing grade of "700 out of 1000 points". The AAISM is a fixed exam of 90 four-option questions on one 150-minute clock.

A date to know. ISC2's outline page says: "Effective April 15, 2027, the CISSP exam will be based on a new exam outline."

What the AAISM adds that the CISM and CISSP do not

The AAISM's outline reads like a security manager's job description with AI written into every line, and several of its tasks have no counterpart in either prerequisite. Among the 22 tasks ISACA lists:

• "Conduct AI impact assessments and ensure conformity with regulatory requirements."
• "Conduct risk-based human oversight of AI inputs/outputs including trust and safety, quality, explainability, and robustness."
• "Identify and treat security risk associated with data used in the AI life cycle."
• "Advise on the integration of AI architecture as part of enterprise architecture."
• "Embed, monitor, and verify AI security requirements when utilizing vendor AI-enabled solutions."

Its Domain 3 topics go further into the technology than a management credential usually does, taking in the AI life cycle, with "model selection, training, and validation" as ISACA's examples, data management controls, and privacy, ethical, trust and safety controls. A CISM or CISSP knows how to govern, assess and protect systems; the AAISM asks what changes when the system learns from data, produces outputs nobody wrote, and can be manipulated through its inputs. That is the knowledge a security manager needs before AI arrives in every business unit, and it is what neither prerequisite was built to test.

CISM or CISSP: which is the better route to the AAISM?

ISACA does not prefer either: the guide's prerequisite is simply "an active CISM or CISSP". But the route you take changes three things after you are certified.

1. Paperwork. ISACA's CPE policy asks Advanced certification holders to "Submit evidence of the maintenance of one of the approved prerequisite certifications. If you used an ISACA certification as your prerequisite certification, no evidence is required." A CISM holder sends nothing; a CISSP holder sends evidence that the CISSP is still active.
2. Continuing education. The AAISM needs 10 CPE hours a year, all mapped to its outline. A CISM holder keeps both credentials under one ISACA policy, where the CISM's minimum is 20 hours a year, and ISACA's maintenance page says hours can count for more than one ISACA certification when the activity serves each. A CISSP holder keeps the CISSP under ISC2's rules and the AAISM under ISACA's.
3. One body or two. With a CISM and the AAISM, your renewals, fees and audits all run through ISACA. With a CISSP and the AAISM, they run through two bodies.

None of that should decide your first credential, though. Choose the CISM or the CISSP for the work you do; the AAISM accepts either.

Which should you take first?

ISACA's blog gives a simple test for the two prerequisites: "Want to design and implement security programs? Go with CISSP. Want to manage and lead security functions? CISM is ideal." And for the AAISM: "Want to layer AI expertise into your security or audit knowledge? AAISM can build on your CISM or CISSP background". Its shorthand for the difference is "CISSP secures information. CISM manages security."

Put as paths:

• You hold neither, and you run security programs: CISM first, then the AAISM.
• You hold neither, and your work is hands-on security as well as management: CISSP first, then the AAISM.
• You hold a CISM or a CISSP, and AI is arriving in your organization: the AAISM next.
• You hold both: take the AAISM through either; the CISM saves the yearly evidence.

Both prerequisites ask for years of experience, five for the CISM with waivers for up to two, and five for the CISSP, so for someone early in a security career, the AAISM is a later step, not a first one.

Is the AAISM harder than the CISM or CISSP?

None of the bodies publishes a pass rate, so there is no official comparison. What can be compared is the exam itself. The AAISM is shorter and narrower than either prerequisite: 90 questions on one subject area against the CISM's 150 over four domains or the CISSP's eight domains. But it is an advanced exam that assumes the CISM or CISSP knowledge and asks you to apply it to AI, where many candidates have less experience than in security itself. A CISM holder will find the question style familiar, since both are ISACA exams with "one best answer"; a CISSP holder moves from an adaptive exam to a fixed one. How hard is the AAISM exam? takes its difficulty feature by feature.

Recognition: accreditation and the DoD

ISACA's 2026 candidate guide says that "The American National Standards Institute (ANSI) has accredited the CISA, CRISC, CISM, and CGEIT certifications under ISO/IEC 17024:2012". ISC2's CISSP page lists "ANAB Accredited ISO/IEC Standard 17024". The AAISM's candidate guide and pages make no accreditation claim for it.

For US government work, ISACA's blog page notes that "Certified Information Systems Auditor (CISA) and Certified Information Security Manager (CISM) are now approved for use with the U.S. Department of Defense DoD Manual 8140.03 Cyberspace Workforce Qualification and Management Program", and ISC2's CISSP page lists "U.S. DoDM 8140.03 Approved by Department of Defense". Neither body's pages make that claim for the AAISM. If a contract or role requires an 8140 qualification, your CISM or CISSP is the credential the bodies say is approved for it, and the AAISM adds AI on top.

Where to start

If you already hold a CISM or CISSP, the AAISM is the next step to look at. A free account opens the first topic, AI governance and regulation, in full: its 147 questions with rationales, its lessons and its flashcards, plus a short diagnostic and a study plan. AAISM certification requirements sets out every step from registration to renewal, and the AAISM vs AAIA vs AAIR compares it with ISACA's other AI credentials. Full access to all 63 lessons and 1,717 questions is a single payment, with nothing to renew.