The AAISM is 90 multiple-choice questions in 150 minutes, about 100 seconds per question. Domain 3, AI Technologies and Controls, carries 38% of the score, the largest share of any domain. This guide covers the official exam facts, how to split your preparation across the three domains, and where to practice.
TL;DR
- 90 multiple-choice questions, 150 minutes, 450 out of 800 to pass on a 200 to 800 scale
- You have 6 months from registration to take the exam; a one-time 6-month extension costs US$75
- An active CISM or CISSP is required to become certified, not to take the exam
- Domain weights: 31% AI Governance and Program Management, 31% AI Risk, 38% AI Technologies and Controls
- Exam fee US$459 for ISACA members, US$599 for non-members, plus a US$50 application fee after you pass
Quick Facts
| Item | Value |
|---|---|
| Exam fee | US$459 (ISACA member) / US$599 (non-member) |
| Application fee | US$50, paid after passing |
| Length | 150 minutes |
| Questions | 90 multiple-choice (scored items plus unscored pretest items) |
| Passing score | 450 on a scaled score of 200 to 800 |
| Languages | English, Spanish, Japanese |
| Eligibility window | 6 months from registration; one 6-month extension for US$75 |
| To become certified | Active CISM or CISSP, pass the exam, apply and pay the application fee |
| Maintenance | At least 10 CPE per year, 30 over three years; annual fee US$20 (member) / US$35 (non-member) |
| Retakes | Up to 4 attempts in a rolling 12 months: wait 30 days after attempt 1, then 90 days after each later attempt |
How Should I Study for the AAISM?
Start with the official AAISM Exam Content Outline on ISACA's site. It lists what each domain covers, and it is the document your study plan should follow, not a prep blog.
Split your time by weight. Domains 1 and 2 are 31% each, so together they are 62% of the exam, but Domain 3 alone is 38% and outweighs either of them. Plenty of candidates with a governance background end up under-preparing the largest domain when they spend equal time on all three.
Then work in three passes:
- Read the outline domain by domain. For each task statement, check that you can explain it in your own words and apply it to a scenario.
- Practise in timed sets. At 150 minutes for 90 questions you have roughly 100 seconds per question, so practise at that pace.
- Review every explanation, including for questions you got right. The goal is to understand why each wrong option fails, not to memorise answers.
Where Can I Practice with Realistic AAISM Questions?
ISACA sells a Questions, Answers & Explanations (QAE) database with 200+ questions as a six-month subscription, and publishes a free 12-question practice quiz on the AAISM page. The quiz is a quick way to see the question style before you pay for anything.
CertCompanion's AAISM practice questions give you scenario-based practice with an explanation for every option. Start with the 30 free questions to find out which domains need work before you commit to a study plan.
| AAISM question bank | |
|---|---|
| Questions | 600 |
| Single-answer | 398 |
| Select-all-that-apply | 202 (34%) |
| Median explanation length | 86 words |
What Score Do I Need to Pass the AAISM?
The passing score is 450 on a scaled score of 200 to 800. You see your preliminary pass or fail status on screen right after the exam, and the official score is emailed and posted online within 10 working days. Domain-level results are informational only: your score is based on the total number of items answered correctly, not on any single domain.
What Does the AAISM Cover, and How Is Each Domain Weighted?
ISACA's June 2025 content outline splits the exam into three domains, each with named subtopics. Use the weights to decide how much time each one gets, and the subtopics as your checklist.
Domain 1: AI Governance and Program Management (31%)31%
This domain covers how an organization governs and runs AI security as a program. The outline names five subtopics:
- 1A Stakeholder considerations, industry frameworks, and regulatory requirements
- 1B AI-related strategies, policies, and procedures
- 1C AI asset and data life cycle management
- 1D AI security program development and management
- 1E Business continuity and incident response
The outline's task statements for this area include setting up the charter, roles, and responsibilities for governing AI, maintaining AI-specific security policies and procedures, building an inventory and classification of AI data and assets, and handling AI security incidents through containment, notification, escalation, eradication, and recovery.
Domain 2: AI Risk and Opportunity Management (31%)31%
This domain covers how AI risk is assessed, treated, and monitored. It has three subtopics:
- 2A AI risk assessment, thresholds, and treatment
- 2B AI threat and vulnerability management
- 2C AI vendor and supply chain management
Related task statements include running the AI risk management life cycle (including impact on enterprise risk), identifying and assessing the AI threat landscape, conducting AI impact assessments, and verifying that security requirements are met when you use vendor AI-enabled solutions.
Domain 3: AI Technologies and Controls (38%)38%
This is the largest domain, at 38% of the exam. Its five subtopics are:
- 3A AI security architecture and design
- 3B AI life cycle, for example model selection, training, and validation
- 3C Data management controls
- 3D Privacy, ethical, trust, and safety controls
- 3E Security controls and monitoring
The task statements here include designing and implementing security architecture for AI, advising on how AI architecture fits into enterprise architecture, designing and reviewing AI security controls so risk is treated to an acceptable level, defining and monitoring security metrics for AI solutions, and conducting risk-based human oversight of AI inputs and outputs, including trust and safety, quality, explainability, and robustness. Domains 1 and 2 together are 62% of the exam, but Domain 3 alone outweighs either of them. If you are mapping out which ISACA credential to take after this one, the ISACA certification practice exams page lists the others. If you come from a governance background, give Domain 3 extra time rather than an equal share.
How a Realistic AAISM Question Works
A healthcare organization implements third-party AI vendor risk management following ISACA's six-step due diligence process. The vendor provides a diagnostic imaging AI system. Which step should include proportionate risk assessment based on the system's potential impact? (Select one!)
- A. Step 1: AI Strategy and Needs Identification when defining organizational requirements
- B. Step 2: Planning and Supplier Identification during vendor market research
- C. Step 3: Due Diligence and Risk Decision when evaluating vendor and system risks
- D. Step 5: Monitoring, Auditing, and Awareness during ongoing vendor oversight
Show the answer and the reasoning
Correct answer: C. Step 3: Due Diligence and Risk Decision when evaluating vendor and system risks
Step 3 Due Diligence and Risk Decision is the explicit step where ISACA's methodology requires proportionate risk assessment based on the AI system's potential impact. This step evaluates vendor capabilities, model risks, bias testing, security controls, and determines whether risks are acceptable before contract execution. Healthcare diagnostic imaging represents high-risk AI requiring thorough due diligence at this stage. Step 1 identifies needs but does not perform vendor-specific risk assessment. Step 2 involves supplier identification, not detailed risk evaluation. Step 5 focuses on post-deployment monitoring, not initial risk decision-making.
How Are AAISM Questions Written?
Per the official exam guidance, every question has a stem and four answer options, and every question is designed with one best answer. The stem can be a question or an incomplete statement. Some questions hinge on a qualifier such as MOST likely or BEST, so read each stem carefully and look for that word before you choose.
The guide also says to eliminate options you know are wrong and then make the best choice from what is left. There is no penalty for a wrong answer, and your grade is based solely on the total number of questions you answer correctly, so answer every question rather than leaving any blank. The exam also includes unscored pretest items, which are not used to calculate your score, and you cannot tell which ones they are.
When you practise, copy that format. Read the stem, find the qualifier, rule out the options that do not fit, and pick the best remaining answer. Then read the explanation for every option, not only the one you chose.
Who Can Sit the AAISM, and What Do I Need Before Registering?
Exam registration is continuous, so you can register at any time, and you can schedule an appointment as early as 48 hours after you pay. From the day you register you have six months to take the exam. If you need more time, you can buy a single six-month extension for US$75; it appears on your dashboard 30 days before and after your eligibility ends. Cancel any scheduled appointment at least 48 hours ahead to extend.
An active CISM or CISSP is one of the requirements for becoming certified: hold the credential, pass the AAISM exam, pay the US$50 application processing fee, submit the application, and follow ISACA's Code of Professional Ethics and the AAISM CPE policy.
The exam fee is US$459 for ISACA members and US$599 for non-members, nonrefundable and nontransferable. Pay it in full before you schedule.
How Do I Turn the Content Outline into a Study Checklist?
The outline lists 22 task statements, and they are the most concrete description of what ISACA expects an AAISM holder to do. Turn them into a checklist and rate yourself honestly on each one from "can explain it and apply it to a scenario" down to "have not met this before." A few examples of what the tasks ask for:
- Define and monitor security metrics for AI solutions used across the organization
- Review and implement AI security tools as part of the information security program
- Develop and maintain AI-specific security awareness training and acceptable use guidelines
- Advise on security risk and controls across the AI solution development life cycle
- Address AI security risk as part of business continuity and disaster recovery planning
- Establish and maintain processes to investigate, document, and report AI security incidents in line with regulatory and contractual requirements
Anything you rate as unfamiliar goes to the top of your plan, weighted by its domain. A weak task in Domain 3 costs more than a weak task in Domain 1, because Domain 3 carries 38% of the exam. Re-rate yourself after each timed practice set, and spend the final week on the tasks that are still weak rather than re-reading the ones you already know.
How Long Should I Plan to Prepare?
Book your exam date early and plan backward from it. The 6-month eligibility window gives you a firm deadline, and an extension costs US$75, so register when you are ready to start studying, not as a placeholder. A sensible rhythm is one pass through the outline, then timed practice sets, then a review of the domains where your practice scores are lowest.
On exam day, keep roughly 100 seconds per question in mind. Flag any question where you are not making progress, move on, and return to flagged questions after you have been through the full set.
What Should I Know About Exam Day?
The AAISM is computer-based. You take it at an authorized PSI testing center or as a remotely proctored exam. A tutorial on the exam software is shown after you log in at the testing station and before the exam starts, so pay attention to it.
If you test at a center, plan to arrive at least 30 minutes before the start time, and work out your route and where you will store your belongings beforehand. One break of no more than ten minutes is allowed with your proctor's permission. The exam pauses during an approved break, but the timer does not stop, so a break costs you exam time.
Treat the 150 minutes as a budget. With 90 questions that is about 100 seconds per question. Make a first pass, flag the questions where you are not making progress, and return to them once you have answered everything else.
If you cannot take the exam inside the six-month window, or you miss your appointment, or you arrive more than 15 minutes late, the exam eligibility and the registration fee are forfeited. Rescheduling or cancelling needs at least 48 hours notice.
After the exam, you can ask for a rescore in writing through ISACA's support page if you do not pass, within 30 days. Rescores are performed by PSI.
Frequently Asked Questions
Do I need CISM or CISSP to take the AAISM exam? Not to sit the exam: registration is continuous. You need an active CISM or CISSP to become certified after you pass, along with the application and the US$50 processing fee.
How many retakes are allowed, and how long do I have to wait? You have four attempts within a rolling 12-month period. After a failed first attempt you wait 30 days from that attempt, and after each later failed attempt you wait 90 days. You pay the registration fee in full for every attempt.
How is the score reported? You see your preliminary passing status on screen immediately after the exam. The official score is emailed and available online within 10 working days. Scores are reported on a scale of 200 to 800, and 450 or higher passes.
What is the separate US$50 fee for? It is the application processing fee you pay after passing, as one step of becoming certified. Someone who passes cannot retake the same exam within the five-year application period.
What is the annual maintenance requirement after passing? At least 10 CPE per year and 30 over a three-year reporting period, and an annual maintenance fee of US$20 for members or US$35 for non-members, due by 1 January. You must also keep an active CISM or CISSP.
In which languages is the exam offered? English, Spanish, and Japanese.
Ready to find your gaps before exam day? Start with free AAISM practice questions at CertCompanion.
Checked against official ISACA AAISM exam documentation and current candidate reports. Last verified 2026-10-30.