AAISM is Advanced in AI Security Management, ISACA’s credential for the person responsible for securing AI systems rather than auditing them. It requires an active CISM or CISSP before you can register.
It sits alongside AAIA, which covers the same territory from the audit side. Your job should decide which one you take, not your interest.
Who Can Sit It
You need an active CISM or CISSP. It can’t be expired or an associate status. That’s a real gate. Both credentials already require years of documented experience. AAISM assumes an established security manager, not someone new to the field.
What Does It Cover?
Three practice areas:
AI Governance and Program Management: Standing up an AI security program, defining policy, and fitting AI oversight into existing governance instead of building a parallel structure.
AI Risk Management: Identifying and treating risk specific to AI systems. Model behavior, training data, supply chain risk from third-party models, and failure modes that traditional application risk assessment misses.
AI Technologies and Controls: The technical half. What controls exist for AI systems, where they apply, and how to judge whether they are working.
ISACA has not published percentage weights across the three areas, unlike CISM where domain weights are part of the outline. Check the current exam content outline before you plan your study time.
How It Compares to CompTIA SecAI+
Both are recent AI security credentials, and they sit at opposite ends of the same subject.
SecAI+ is practitioner level and open to anyone. AAISM is management level and gated behind CISM or CISSP. SecAI+ leans toward the technical work of securing AI systems and using AI in security operations. AAISM leans toward program, policy and risk. Technical controls are one of its three areas, not the focus.
If you run the security program and answer to the board for AI risk, AAISM is the fit. If you’re implementing the controls, SecAI+ covers more of the day-to-day work.
Who Should Take AAISM?
Security managers and CISOs whose organization has deployed AI and now has to govern it. People writing AI acceptable use policy, running model risk assessments, or being asked by a board what the exposure is.
The usual caution for a new credential applies. It’s too new to show up in job ads yet. Right now its value is the structure it gives to work you already do, not the recognition it carries. That is a reasonable trade if AI governance has landed on your desk. It is a poor one if you are collecting certifications.
Exam Details
- Full Name: Advanced in AI Security Management (AAISM)
- Issuer: ISACA
- Practice Areas: AI Governance and Program Management, AI Risk Management, AI Technologies and Controls
- Prerequisite: Active CISM or CISSP
- Exam Cost: $459 USD member, $599 USD non-member
- Application Fee: $50 USD after passing
- Eligibility Period: 6 months from registration to sit the exam
- Application Deadline: Within 5 years of passing
The $140 gap between member and non-member pricing is close to the cost of ISACA membership. If you’re taking the exam, do the math on joining first. To hold the certification, you also follow ISACA’s Code of Professional Ethics and its continuing professional education policy. These are the same rules that come with CISM.
What Comes After AAISM?
AAISM is an advanced credential rather than a step on a ladder, so the useful moves are lateral. CRISC covers enterprise risk management, which is where AI risk gets reported in the end. CDPSE covers privacy engineering, and the overlap with AI data governance is substantial.
If the technical side is where you want to go deeper, SecAI+ approaches the same subject from the practitioner end.
Retired Army Chief Warrant Officer. Twenty years in cyber ops. Now in government consulting.