Question 1

Who is eligible for the AAISM certification?

Accepted Answer

AAISM requires an active CISM or CISSP credential — there is no waiver, no experience substitution and no alternative qualifying certification. ISACA designed AAISM as an advanced credential that assumes you already hold a recognised security management or security practitioner certification, so the prerequisite is checked at registration rather than at application. If your CISSP or CISM has lapsed, you will need to reinstate it before registering. If you are currently studying for either, you become eligible on the day your credential goes active, which is why many candidates finish the prerequisite and move straight into AAISM while still in study rhythm. If you hold neither, AAISM is not your next step — but there is a clear route, and it starts with CISSP or CISM.

Question 2

What is the AAISM exam format and passing score?

Accepted Answer

The AAISM exam is 90 multiple-choice questions in 150 minutes, scored on a 200–800 scale, with 450 required to pass. Every question has one best answer, and the format is linear rather than adaptive — which means you can flag questions and return to them, and no question is worth more than any other. The exam is delivered through PSI, either at a test centre or under remote proctoring, and is available year-round. Your eligibility window is 6 months from registration. Because the exam is linear, a two-pass strategy works well: answer everything in order at roughly 100 seconds per question, then return to your flags with the time you have banked.

Question 3

What are the three AAISM domains and how much is each worth?

Accepted Answer

AAISM covers three domains: AI Governance and Program Management at 31%, AI Risk Management at 31%, and AI Technologies and Controls at 38%. Domain 1 covers AI readiness, roles and accountability, standards and regulations, strategy, policy and AI incident response. Domain 2 covers AI-specific threats, adversarial attacks, bias, model and data risk, third-party and supply chain risk, and risk treatment. Domain 3 covers the technology itself — types of AI, machine learning paradigms, neural networks, secure architecture, the seven-phase AI life cycle, TEVV, data governance, privacy, drift and human oversight. Domain 3 is the largest single block on the exam and the one most candidates underprepare.

Question 4

How long does it take to prepare for AAISM?

Accepted Answer

Most CISSP or CISM holders need six to eight weeks of structured study, and the Cybernous programme is built as 50 days — 45 study days, 5 rest days, plus an uncounted Day 0 primer. Study days run 30 to 38 minutes of reading, with a separate 10 to 15 minutes for the week’s practical artifact. That pacing is deliberate: it is designed for someone holding a full-time security role, not for someone on study leave. Candidates who already work in AI governance sometimes move faster through Domains 1 and 2, but almost nobody should compress Domain 3, which is 38% of the exam and usually the least familiar material.

Question 5

How much does AAISM cost in total?

Accepted Answer

The ISACA exam fee is USD 459 for ISACA members and USD 599 for non-members, plus a USD 50 application fee payable after you pass. Those amounts go directly to ISACA and are separate from any training fee — registering for the exam and enrolling in a preparation programme are two different transactions with two different organisations. ISACA membership can pay for itself at registration, so it is worth doing the arithmetic before checkout. Certification maintenance then requires 10 CPE hours per year in the AI domain and 30 hours across each three-year cycle. For Cybernous training fees and current cohort options, book a strategy call — pricing depends on the format you choose.

Question 6

Is AAISM worth it for a CISSP or CISM holder?

Accepted Answer

For a security manager who is already being asked AI questions they cannot fully answer, AAISM is worth it — because it certifies the specific accountability gap the market is currently trying to fill. Boards, regulators, auditors and insurers have all begun asking who owns AI risk, and the EU AI Act, NIST AI RMF and ISO/IEC 42001 all assume that person exists and is competent. AAISM is currently the only ISACA credential aimed at that seat. The honest counter-argument: if your organisation has no AI deployment and no near-term plan for one, the credential will sit unused. It rewards people who will actually do the job.

Question 7

What is the difference between AAISM and AAIA?

Accepted Answer

AAISM is ISACA’s AI security management credential and AAIA is ISACA’s AI audit credential — the difference is the chair you sit in, not the difficulty. AAISM is for the person accountable for how AI is adopted, governed and secured: the policies, the controls, the risk decisions, the incident response. It requires an active CISM or CISSP. AAIA — Advanced in AI Audit — is for the person providing independent assurance over somebody else’s AI, and is built for CISA holders. They complement rather than compete, and mature organisations end up with both, held by different people, exactly as they do with CISM and CISA.

Question 8

Do I need an AI or machine learning background to pass AAISM?

Accepted Answer

No. You need AI literacy, which is a far smaller and more learnable thing than an ML background. AAISM does not ask you to build a model, tune an algorithm or write code. It asks you to recognise what a model is, what changes when a system learns from data instead of following written rules, and what a security manager does about it. That is roughly nine core concepts, and they can be learned properly in a single evening — which is exactly why the Day 0 AI Literacy Primer exists and why it comes before any governance content. Candidates who skip that foundation spend three weeks nodding along to Domain 3. Candidates who do it read the same material as engineering they can reason about.

Question 9

How is Cybernous AAISM training different from a bootcamp or self-study?

Accepted Answer

The difference is sequence and duration. A two-day bootcamp delivers slides against material that is genuinely new to most of the audience, and self-study leaves the hardest 38% of the exam to be self-diagnosed. This programme runs 50 days, opens with an AI literacy foundation before any governance content, allocates time in proportion to the real domain weights, and builds in five full-length mocks under exam conditions with remediation between them rather than stacked at the end. You also get 1:1 mentorship with Coach Manoj himself, revision days at the end of each domain, and the Confusion Clinic, which drills every lookalike pair on the syllabus.

Question 10

What happens if I am not eligible for AAISM yet?

Accepted Answer

You take the prerequisite first, and there is a well-worn path. If you hold neither CISSP nor CISM, start with whichever fits your role — CISSP for a broad security practitioner, CISM for a management-focused one — typically 60 to 100 days with us, then move into AAISM immediately after while your study habit is still intact. If you need AI security capability sooner than a credential allows, GAESP is our GenAI security programme with no prerequisite at all, open to AI/ML engineers, privacy officers, auditors and risk managers. A strategy call will map the shortest honest route for your role in about twenty minutes.

What preparation needs	Self-study (Review Manual + QAE)	2-day bootcamp	Cybernous AAISM Toolkit
AI literacy foundation before governance			Day 0 primer
Live coaching		2 days	Throughout
1:1 mentorship with the instructor			yes
Structured day-by-day plan			50 days
Domain-weighted time allocation	DIY	Generic	31 / 31 / 38
Full-length mocks (90 Q / 150 min)	Limited	1	5
Domain revision days			One per domain
Confusion Clinic — lookalike pairs			yes
Practical artifacts you keep			8

Phase	When	Focus	Domain
Primer	Before Day 1	AI literacy foundation — the vocabulary the syllabus assumes	—
Foundation	Phase 1	AI governance and programme management, closing with a revision day	D1 · 31%
Risk	Phase 2	AI threats, bias, model and supply chain risk, closing with a revision day	D2 · 31%
Technology	Phase 3	Types of AI, life cycle, TEVV, controls, closing with a revision day	D3 · 38%
Final Sprint	Phase 4	Five full-length mocks, Confusion Clinic, exam strategy	All

Number of questions	90
Duration	150 minutes (2.5 hours)
Question type	Multiple choice, one best answer
Scoring scale	200–800
Passing score	450
Delivery	PSI test centre or remote proctored, year-round
Eligibility window	6 months from registration
Exam fee	USD 459 ISACA member / USD 599 non-member
Application fee	USD 50 after passing
CPE to maintain	10 hrs/year in AI; 30 hrs per 3-year cycle

AAISM Certification Training — The AI Layer on Top of Your CISSP

Get Your Personalised AAISM Study Plan

You have run security programmes for years. Nobody taught you what a model is.

The judgment

The vocabulary

The plan

What is the ISACA AAISM certification?

Why a two-day AAISM bootcamp cannot work

Day 0 — the AI literacy primer nobody else gives you

A 50-day AAISM study plan, honestly counted

The three AAISM domains — and where the exam actually sits

AI Governance and Program Management

AI Risk Management

AI Technologies and Controls

AAISM exam format, scoring and cost

Can you sit AAISM? The honest answer.

You hold an active CISSP or CISM

You are preparing for CISSP or CISM, or awaiting endorsement

You hold neither

Everything in the AAISM Success Toolkit

Day 0 AI Literacy Primer

Live theory sessions

Live exam practice sessions

The 50-day structured plan

Smart notes for all three domains

Eight practical artifacts

AAISM-format question bank

Five full-length mocks

Domain revision days

The Confusion Clinic

1:1 mentorship with Coach Manoj

180-day LMS access

You finish with an AI governance programme, not a folder of notes

Manoj Sharma

AAISM, AAIA or GAESP — which one is yours?

AAISM

AAIA

GAESP

2,000+ professionals certified using this coaching method

Local context, local currency, your timezone

Gulf

APAC

Americas

Europe

Still Confused? Request a Callback

AAISM certification — frequently asked questions

Free AAISM domain summaries

AAISM Domain 1 summary

AAISM Domain 2 summary

AAISM Domain 3 summary

How we compare with other AAISM training providers

AAISM training comparison hub

Cybernous vs Destination Certification

Cybernous vs QA

Cybernous vs Sutra Academy

Cybernous vs Training Camp

Cybernous vs Udemy

Other programmes you may be weighing up

CISM Success Toolkit

GenAI Expert Cybersecurity Professional (GAESP)

CISSP Success Toolkit

Start Your 50-Day AAISM Certification Training