AAISM Prerequisites: CISM or CISSP First

The short version

To take the AAISM exam you must hold an active CISM or CISSP. ISACA’s AAISM page says so directly, and its candidate guide repeats it as a requirement for becoming an AAISM holder. The pages we read do not state a separate work-experience requirement for AAISM, but they do describe the audience as experienced professionals with proven security or advisory experience and some expertise in AI systems.

The hard requirement

  • An active CISM or CISSP. ISACA’s AAISM page says candidates must hold one of them. The candidate guide lists “have an active CISM or CISSP (ISC2)” as the first requirement for becoming an AAISM holder.
  • Keep it active. To maintain AAISM, ISACA asks you to submit proof that your CISM or CISSP is active, so a lapse affects you later too.
  • A name that matches. The name on your ISACA account must match the name on the government ID you present on exam day.

Whatever else you take from this page, check the requirement on ISACA’s AAISM page before you pay, since requirements can change. The experience rules of CISM and CISSP themselves are set by their issuers, so look those up with them.

What the exam assumes you know

ISACA does not publish a reading list of prerequisites beyond the credential, but the content outline makes the assumed background fairly clear. Because AAISM sits on a security management credential, expect to need:

  • Risk management basics: risk, threat, vulnerability, impact, treatment options.
  • Policy structure: how policies, standards, and procedures relate.
  • Incident response: containment, escalation, eradication, and recovery.
  • Third-party risk: contracts, assurance, and audit rights.
  • Business continuity and disaster recovery planning.
  • Security architecture and access control concepts.

On top of that, you need a working picture of how AI systems are built and used. It is conceptual, not code: training and inference, models and data, retrieval and agents, and what can go wrong at each stage.

Skills self-check

Read each line and answer honestly. If you hesitate on more than a few, plan extra time with that topic.

  1. I can explain the difference between governance and management.
  2. I can explain risk appetite versus risk tolerance and which one is set first.
  3. I can name the standard options for treating a risk and give an example of each.
  4. I can describe, in a sentence, what happens during model training and what happens during inference.
  5. I can explain in simple terms what data poisoning, prompt injection, and model extraction are.
  6. I know why an AI system can cause harm even when nobody attacks it.
  7. I can say what an AI asset inventory should record.
  8. I can describe why a supplier’s AI service needs different questions than ordinary software.
  9. I understand why access control for retrieved documents must be enforced before the model sees them.
  10. I can explain what an impact assessment is for and how it differs from a risk assessment.

Useful but not required

ISACA does not require any specific AI course, and we did not find a vendor-named learning path on the pages we read. The following background helps, but treat it as your own preparation choice:

  • Having worked on or reviewed a project that uses a language model or other machine learning.
  • Reading the public guidance on AI risk that your organization already follows.
  • Skimming ISACA’s exam content outline and its 22 task statements to see the job the exam describes.

If you do not hold CISM or CISSP yet

Then AAISM is not available to you yet. The sensible order is to earn CISM or CISSP first, then return to AAISM. You can still read about AI security in the meantime, and practice material can help you learn concepts, but you cannot sit the exam without the base credential.

More guides for AAISM

Next step

Once you meet the requirement, the study plan shows how to schedule your preparation. If you want to see where you stand now, our AAISM practice tests give a domain-by-domain picture, and the exam overview links to every page in this guide.

Try these practice exams