The AAISM exam, in plain English
Updated 16 October 2026. Exam facts are from ISACA's AAISM certification page and its exam candidate guide. Check both before you book, because ISACA can change them.
Who can take AAISM
ISACA requires an active CISM or CISSP certification. It also says candidates should have some experience assessing, implementing and maintaining AI systems.
Passing the exam is one step. To hold the certification you then apply within five years of passing, pay a US$50 application fee, and agree to ISACA's Code of Professional Ethics and its continuing professional education policy.
Exam format
| Item | Detail |
|---|---|
| Questions | 90 multiple-choice |
| Time | 2.5 hours (150 minutes), about 100 seconds a question |
| Score | Scaled from 200 to 800. You need 450 or more to pass. |
| Languages | English, Spanish and Japanese |
| Where | At a PSI test centre, or online with a remote proctor |
| Exam fee | US$459 for ISACA members, US$599 for non-members, as listed by ISACA in October 2026 |
How the score works
ISACA reports a scaled score: your raw result converted to a common 200 to 800 scale, so different versions of the exam are comparable. Some questions are unscored pretest items. You also get results by domain, which show where you were weakest.
ISACA does not publish how raw scores convert to the scale. CyberQue's mock exams report on the same 200 to 800 scale and place the 450 pass mark at 70% correct. Treat that as a guide to how ready you are, not a prediction of your result.
The three domains
The exam follows ISACA's AAISM exam content outline, which has three domains and 22 supporting tasks. CyberQue tags every question to one of 13 sub-domains. The short descriptions below are ours, written as a study aid, not ISACA's titles.
1. AI Governance and Program Management (31%)
- Charter, roles and responsible AI use
- AI security policies and standards
- AI data and asset inventory
- Metrics, tooling, awareness and SDLC advisory
- AI incident response and continuity
2. AI Risk Management (31%)
- Risk lifecycle, reassessment and impact assessment
- Threat landscape and vulnerability testing
- Vendor and third-party AI risk
3. AI Technologies and Controls (38%)
- AI security architecture
- Secure AI development lifecycle
- Data security across the AI lifecycle
- Human oversight, trust and safety
- AI security controls and monitoring
How to practise for AAISM
These are general tips on using practice questions. CyberQue is a study aid of practice questions and mock exams, not a course or training.
- Start with ISACA's documents. Read the exam content outline and the candidate guide, so you know what is tested and how exam day works.
- Learn the frameworks the answers rest on. Across CyberQue's 540 questions, the sources cited most are ISO/IEC 42001 and the other ISO/IEC AI standards, the NIST AI Risk Management Framework, the OWASP Top 10 for LLM Applications, the EU AI Act and MITRE ATLAS.
- Think like a manager. Questions usually ask for the MOST important concern or the BEST next step. Several options are often true; the answer is the one that deals with the underlying problem, at the right level, first.
- Sit a full timed mock early. 90 questions in 150 minutes is a test of pace as well as knowledge. A first score, even a low one, shows you where to start.
- Study your misses, not just the answers. For every question you get wrong, work out why each wrong option loses. That is the skill the exam rewards.
- Book when you pass consistently. One good mock can be luck. Clearing 450 with room to spare, exam after exam, is a better sign.
ISACA also runs official AAISM training.
Practise with CyberQue
CyberQue has 540 AAISM practice questions in six full mock exams, each timed and scored like the format above, with an explanation for every question and every wrong option. Try ten free questions on the web, or start the app with 20 free.
First 20 questions free.
Android 10 or later.
CyberQue is made by CyberQue Digital. It is independent and isn't affiliated with, endorsed by or sponsored by ISACA. AAISM, CISM and CISA are trademarks of ISACA; CISSP is a trademark of ISC2.