The short version
Most candidates who already hold CISM or CISSP will want somewhere between 40 and 70 hours of focused study, spread over four to eight weeks. ISACA does not publish a recommended number of hours, so treat these figures as general guidance that depends on how much hands-on AI experience you have. Use the 4-week plan if you work with AI systems daily. Use the 8-week plan if the technical domain is new to you.
Both plans follow the three domains in ISACA’s exam content outline: AI Governance and Program Management (31%), AI Risk Management (31%), and AI Technologies and Controls (38%). The domains explained page describes each one.
Before you start
Do three things first.
- Read ISACA’s exam content outline once, including the 22 task statements. It is your checklist.
- Take one practice set cold, without studying. Ignore the total score. Look at the split by domain.
- Write down your weakest area. Spend your first study block there.
Your study material is whatever ISACA and public AI-security guidance give you. Practice exams show you gaps; they do not teach the body of knowledge from scratch.
The 4-week plan (about 10 to 14 hours a week)
Week 1: Governance and the program
Cover stakeholder needs, frameworks, and regulatory requirements; AI strategy, policies, and procedures; and the AI asset and data life cycle. Learn the difference between governance and management, and between a policy, a standard, and a procedure. Build an inventory in your head: what counts as an AI asset, who owns it, how it is classified.
Week 2: Governance part 2 and risk
Start with the AI security program, business continuity, and incident response. Then move to risk: assessment, thresholds, and treatment. Be able to explain risk appetite versus risk tolerance, the four treatment options, and why an AI incident can happen with no attacker at all.
Week 3: Risk part 2 and technology
Finish threat and vulnerability management and vendor and supply chain management. Then start the technology domain: architecture and design, the AI life cycle, and data management controls. Learn the common attack types at a conceptual level (poisoning, evasion, extraction, prompt injection) and the control that fits each.
Week 4: Controls, then simulate
Cover privacy, ethical, trust, and safety controls, and security controls and monitoring. Spend the last third of the week on timed full-length practice, then review every miss.
The 8-week plan (about 5 to 8 hours a week)
| Week | Focus | Practice |
|---|---|---|
| 1 | Outline, vocabulary, baseline | One cold practice set; read the outline |
| 2 | Domain 1: stakeholders, frameworks, regulation, policies | 30 to 40 questions on Domain 1 |
| 3 | Domain 1: asset and data life cycle, program, continuity, incidents | Review all Domain 1 misses |
| 4 | Domain 2: risk assessment, thresholds, treatment | 30 to 40 questions on Domain 2 |
| 5 | Domain 2: threats, vulnerabilities, vendors and supply chain | Review all Domain 2 misses |
| 6 | Domain 3: architecture, life cycle, data controls | 40 to 50 questions on Domain 3 |
| 7 | Domain 3: privacy, ethics, trust, safety, monitoring | Review all Domain 3 misses |
| 8 | Weak areas, then timed full-length practice | One full 90-question run in 150 minutes |
How to use practice exams in the plan
- Early: one practice set cold, to find gaps. The score does not matter yet.
- Middle: short sets by domain after each study block, then read the explanation for every question, including the ones you got right. A right answer reached by a half-guess is still a gap.
- Late: a full-length run under the real clock (90 questions, 150 minutes), without notes. Our sets have five tests with 90 questions each, so you can do this more than once.
- Keep an error log. Write one line per miss: the concept, why the right answer wins, and why your choice lost. Patterns show up fast. A common slip on “FIRST” questions is choosing the best long-term action instead of the step that must come before everything else.
What to do in the last three days
- Three days out: one final timed run. Review misses, but do not start new topics.
- Two days out: reread your error log and the outline. Skim the task statements and ask yourself what each one would look like as a scenario.
- The day before: light review only, 45 minutes at most. Check your ID, your appointment time, and your route or remote-exam setup. ISACA’s rules say your ID name must match your registration.
- Exam day: eat first, because food and drink are not allowed in the room. Pace yourself to about 100 seconds per question. Flag a hard question, answer it with your best guess, and move on, since wrong answers are not penalized.
Adjusting the plan
Add a week if you have not worked with machine learning systems before, or if governance and risk are new to you. Cut the plan down only if your practice results are consistently above your target and stable across domains. A single good run is not enough.
More guides for AAISM
- AAISM Exam Format, Scoring and Retakes
- Is the AAISM Exam Hard?
- AAISM Prerequisites: CISM or CISSP First
- AAISM Renewal and Retakes Explained
- Is AAISM Worth It? An Honest Look
- AAISM Cheat Sheet: Key Facts to Review
- AAIA vs AAISM: Which ISACA AI Exam First?
- AAIR vs AAISM: Which ISACA AI Exam First?
Next step
Pair this schedule with the sample questions to test yourself on each domain early, and use our AAISM practice tests when you are ready for longer runs. Practice results show readiness; they are not a promise of a particular outcome.