ExpertAIGovernance and risk

AAISM

ISACA Advanced in AI Security Management · ISACA

The AAISM is an add-on certification for security managers: it proves you can govern, manage the risks of and secure artificial intelligence systems within an organisation. Launched recently, it is still building its reputation, but it addresses a pressing need now that the EU AI Act is coming into force. Its strength is to extend an existing CISM or CISSP to AI; its limit is that it is reserved for holders of those certifications and is still little known.

Exam
90 multiple-choice questions in 2 h 30, scaled score from 200 to 800 with a pass mark of 450. In a PSI test centre or online with remote proctoring.
Exam price
$459ISACA member price; non-members pay US$599.
Required experience
Hold an active CISM or CISSP. No other certification is accepted.
Validity and maintenance
10 CPE hours per year and 30 over 3 years, an annual fee of US$20 (members) or US$35 (non-members), and the CISM or CISSP kept active.
Format
Multiple choice

Who is it for?

CISOs and security managers already certified CISM or CISSP who must frame the use of AI in their organisation.

Domains covered

  • AI governance and programme management: 31%
  • AI risk management: 31%
  • AI technologies and controls: 38%

Belinda’s take

Information checked on 2 October 2026 against the official site. Prices exclude tax and training, and may change.

Official site

The certification names mentioned are trademarks of their respective owners. KrakenShield is not affiliated with any certification body and does not reproduce any exam question.

All certifications

From theory to practice

So how does your system measure up?

Create your account and get an A+ to F grade for your domains’ encryption in minutes, with every finding explained and the fix to apply.

Run the audit from your account: an A+ to F grade for your domains’ encryption in minutes, with every finding explained and the fix to apply.

Belinda

Contact us

A question, a project, a partnership? Write to us: the team answers by email, usually within one business day.

Your details are only used to answer you. Do not include passwords or vulnerability details.