AAISM study guide
AAISM · Work through your exam, one topic at a time.
The ISACA Advanced in AI Security Management (AAISM) is an AI-centric security management certification. ISACA describes it as "the first and only AI-centric security management certification," designed to help experienced IT professionals reinforce the enterprise's security posture and protect against AI-specific threats. Holders are expected to manage evolving security risk related to AI, implement policy, and ensure responsible and effective use across the organization. AAISM is aimed at practicing security managers rather than newcomers. Topics on this exam: AI Governance and Program Management, AI Technologies and Controls, and AI Risk Management. The AAISM study guide has 3 sections and about 1,186 words.
01AI Governance and Program Management
This domain tests whether you can stand up and run an AI security management program: who decides, what gets documented, how AI systems are inventoried and approved, and how oversight continues after deployment. Questions often ask for the first or best action in a governance scenario, so separate program design from project execution. Governance is ongoing, not a one-time approval. Establish a charter, executive sponsor, cross-functional AI governance committee, RACI, and a policy hierarchy that connects acceptable use, data, security, privacy, and procurement.
401 words, about 2 min02AI Technologies and Controls
This domain tests how AI systems are built, deployed, and controlled in practice: data handling, model behavior, LLM-specific attack surfaces, and technical controls that remain effective after deployment. Expect scenario questions that contrast a prompt-level instruction with an enforcement-layer control. Govern data at ingestion: provenance, quality checks, labeling standards, consent, retention, and lineage. Poisoned or unrepresentative training data is a security and safety issue, not just a data-quality issue.
402 words, about 2 min03AI Risk Management
This domain tests whether you can identify, assess, treat, and monitor AI risk in a way that connects to enterprise risk management. Questions often hinge on risk appetite, inherent versus residual risk, and whether a control actually reduces the risk or only documents it. Define AI risk appetite and tolerance before scoring use cases. Appetite is the amount and type of risk the organization accepts; tolerance is the acceptable variation around it.
383 words, about 2 min