AAISM Renewal and Retakes Explained

The short version

AAISM does not expire on a fixed date, but you have to maintain it. ISACA asks for 10 hours of AAISM-related continuing professional education (CPE) each year, 30 hours over a three-year period, and proof that your CISM or CISSP stays active. If you fail the exam, you wait 30 days before the second attempt and 90 days before each later one, with at most four attempts in a rolling 12 months. All of this comes from ISACA’s AAISM pages and exam candidate guide (version 1.26), checked October 22, 2026.

Two clocks: passing and holding

People mix these up, so keep them apart.

Passing the exam. This starts a five-year window. ISACA says you must apply for the credential within five years of passing, and the passing date must also fall within the last five years of your application.
Holding the credential. Once ISACA grants it, the maintenance rules start. ISACA says CPE is earned and reported starting the calendar year after the credential is granted.

If you pass and never apply, nothing is maintained, because nothing was granted. The pass just ages out.

What maintenance requires

ISACA’s maintenance page lists these items:

CPE hours. At least 10 CPE hours per year, appropriate to AAISM knowledge or to performing AAISM-related tasks, and 30 hours over a three-year reporting period.
Proof of an active CISM or CISSP. You submit it as part of maintenance, so your base credential must stay in good standing.
The Code of Professional Ethics. You agree to follow it.
The annual CPE audit, if you are selected. Chosen holders send supporting records for the activities they reported in a calendar year. ISACA says to keep documentation for 12 months after each three-year cycle ends. Each record should show who attended, the sponsor, the activity title, the date, and the hours claimed.

How CPE gets counted

ISACA pre-loads CPE it tracks into your account, but you still have to apply those hours to a certification before they count. Hours from chapters and other sponsors are self-reported in your myISACA account. The page says hours can count toward more than one ISACA credential when the activity fits each one’s job-related knowledge. ISACA’s page does not give a specific submission deadline beyond the annual and three-year periods, so check your account for dates.

One more caution. ISACA’s other credentials have their own CPE figures, and some ISACA documents quote different numbers. Use the AAISM page, not a general summary.

What happens if you do not comply

ISACA does not use the words “expire” or “lapse” on its AAISM maintenance page. It says that failing to meet the CPE policy or the other requirements results in revocation. Once revoked, you can no longer present yourself as holding the credential, and anyone who asks ISACA to confirm it will see the revoked status.

Reinstatement

ISACA describes an appeal route. You write to the AAISM Working Group through its Customer Experience Center and explain the request in detail, with CPE documentation covering the time since the revocation. If the appeal is approved, outstanding maintenance and reinstatement charges have to be settled. If it is denied, ISACA says returning to active status means passing the exam again and reapplying.

ISACA also mentions Non-Practicing and Retired status options for qualifying holders. The details are on a separate ISACA status page that we do not summarize here.

Retakes in detail

The exam format page gives the short version. Here is the full picture from the candidate guide:

Attempt	Wait before it
First	None
Second	30 days after the first attempt
Third	90 days after the second attempt
Fourth	90 days after the third attempt

You can make four attempts within a rolling 12 months.
You register and pay for every attempt.
If you pass, you cannot sit the same exam again within the five-year application window.
If you fail and disagree with the result, you can ask in writing for a rescore within 30 days of the results release.

The candidate guide also says your registration gives you six months to take the exam. That window belongs to a single registration, not to the whole retake chain.

A sample timeline

This is an illustration, not a promise of dates. Suppose you pass on March 1, 2027.

March 2027. You apply for the credential and, once it is granted, maintenance starts.
Calendar year 2028. Your first year of CPE reporting begins, with 10 AI-related hours needed.
Each year after. You keep your 10 hours and keep your CISM or CISSP active.
By March 1, 2032. The latest date to apply, if you had delayed. Do not rely on this; apply soon after passing.

Now suppose you fail on March 1, 2027. The earliest date for a second attempt is March 31, 2027. If you fail again on that date, the earliest third attempt is 90 days later, at the end of June.

What if the exam changes?

ISACA’s AAISM pages we read did not announce a retirement date or a new exam version. The outline page shows no version or effective date, and the candidate guide’s outline is dated June 2025. Check the ISACA pages before you book, because your registration is tied to the exam as it stands on the day you sit it.

More guides for AAISM

Next step

Planning your first attempt well is the best retake strategy. The study plan and the prerequisites page cover the preparation, and our AAISM practice tests let you check readiness before you pay for an attempt. ISACA’s maintenance page is the authority for every rule above. Back to the AAISM overview.

Frequently asked questions

Does AAISM expire?

ISACA describes maintenance and revocation rather than a fixed expiry date. You stay in good standing by meeting the CPE and CISM or CISSP requirements.

How many CPE hours do I need?

ISACA’s AAISM page asks for 10 hours per year and 30 over three years.

Can I retake right away?

No. The wait is 30 days after the first failed attempt and 90 days after later ones.

Try these practice exams