AAISM: Advanced in AI Security Management · the whole examPass AAISM knowing you’re ready for every domain.
One guide for the whole AAISM exam: every domain of the outline, the 160 practice questions that prove you know it, and nothing left to buy later.
Studying for more than one exam?
- Interactive online guide
- Downloadable PDF
- Lifetime updates
- 30-day money-back guarantee
Secure checkout via Stripe · no account needed · instant access
Studying hard isn't the same as knowing you're ready.
Too much to cover
The AAISM outline is wide, and the books, videos and open tabs keep piling up. You’re studying hard, but you can’t tell if it’s the right material.
No way to know you’re ready
So you book the exam, feel your stomach drop, and push the date back. The doubt costs more study time than the material does.
Expensive to guess wrong
A failed attempt means paying the exam fee again. You shouldn’t have to pay ISACA to find out what you didn’t know.
I've taught this to 700,000 people. Let me help you pass AAISM.
I’m Chris Rees. I’ve spent 25 years in IT and built 55 courses on Pluralsight. The question I hear most isn’t about the material. It’s “am I ready?”
This guide is my answer for AAISM: the whole published outline, in plain English, then exam-style questions that explain why the right answer is right and why the tempting one is wrong.
- students taught *
- 700,000+
- students taught *
- from 2,007 ratings
- 4.6/5
- from 2,007 ratings
- Pluralsight courses
- 55
- Pluralsight courses
- years in IT
- 25+
- years in IT
* From Chris's Pluralsight author dashboard. Course count and ratings are public on his profile.
More about ChrisThree steps from “am I ready?” to passed.
Step 1
Try it first
Read the free excerpt and the sample questions below. If the way it teaches works for you, the rest reads the same way.
Step 2
Study what’s on the test
Work through all 13 modules in exam order, with 160 practice questions along the way.
Step 3
Book it with confidence
When you’re scoring well in every domain, book the exam knowing you’ve covered everything ISACA can ask.
Your whole exam, in one guide
Every domain and every subdomain of the AAISM outline, in the order and proportion the exam weights them. One purchase, nothing left to buy later.
Every objective, nothing extra
Built line by line from the official ISACA AAISM objectives 1A–3E: 120 in-depth topics with worked scenarios and exam tips, in a 283-page guide you'll actually finish.
160 exam-style questions
Every question comes with instant feedback and a full explanation, so a wrong answer teaches you as much as a right one.
The AI credential for security managers
AAISM is ISACA's first AI-centric security management certification, open only to people who already hold CISM or CISSP. It proves you can govern, assess and secure AI across an enterprise, not just use it.
Read a real excerpt, free
This is the actual opening of Module 1A, Stakeholders, frameworks & regulation, not marketing copy. If you like how it teaches, the rest of the guide reads the same way.
Stakeholder considerations, industry frameworks, and regulatory requirements
Who has a stake in an AI system and who is accountable for it, the governance charter that makes those roles real, the frameworks you will be asked to tell apart, and the regulations that turn AI risk into legal obligation.
On a Monday in March, Dana Whitfield, CISO of Keystone Mutual, received a two-line email from the CEO: “The board wants one accountable owner for AI security. That's you. Can you present a governance plan at next month's risk committee?” Dana knew three AI systems: Sable, the GenAI claims assistant (retrieval over policy documents and claim files); Ledger, Marcus Oyelaran's fraud-scoring model; and Pathfinder, an agentic pilot that reads claim emails and files actions through APIs. Within a week they found two more nobody had mentioned: an AI-powered HR screening tool bought by Human Resources, and the office-suite copilot that IT had switched on for 2,400 staff.
That is the first lesson of this subdomain. AI governance does not start with a control catalog. It starts with stakeholders (who is affected, who decides, who is accountable), with the obligations that apply, and a charter tying AI to business objectives. Skillthropic's mapping places ISACA tasks T1 (charter and roles), T3 (responsible use) and T8 (impact assessments and regulatory conformity) here.
Stakeholders: who has a stake, who decides
AI outputs shape decisions about people, so AI touches more parties than a conventional application. A stakeholder analysis lists each party, what it needs and what it can lose; it feeds the charter and the impact assessment.
| Stakeholder | Interest and concern | Keystone example |
|---|---|---|
| Board and executive management | Strategy, risk appetite, regulatory exposure, reputation. Ultimately accountable. | Board risk committee asked for a single accountable owner and a quarterly AI risk report. |
| Business owners (first line) | Value from the use case; they own the process and the risk it creates. | VP Claims owns Sable and Pathfinder; Head of Special Investigations owns Ledger's use. |
| Data science | Model performance, delivery speed. | Marcus's team builds Ledger and Sable's retrieval pipeline. |
| Risk, compliance, legal, privacy (second line) | Regulatory conformity, risk methodology, privacy rights, contractual exposure. | Helen Strand (CRO) owns the enterprise risk framework; the DPO owns GDPR obligations for EU policyholders. |
| Affected individuals | Fair treatment, explanation, contestability, privacy. | Claimants scored by Ledger; job applicants ranked by the HR tool; customers using the Sable chatbot. |
| Regulators | Conformity, consumer protection, market conduct. | US state insurance regulators; EU data protection and AI Act authorities. |
| Vendors and model providers | Contractual scope, liability limits, data use for their own training. | The HR screening SaaS provider; the copilot vendor; the foundation model API behind Sable. |
Two groups are routinely forgotten: affected individuals who are not users (a claimant never logs in to Ledger, yet its score can delay their payout) and downstream parties in the value chain. Internal audit and EU employee representatives, who must be informed before certain workplace AI is used, complete the list.
Try 3 sample questions
Pulled straight from the guide’s 160-question bank. Tap an answer for instant feedback and the explanation.
From module 1A · Stakeholders, frameworks & regulation
1. Keystone Mutual's CEO has just made CISO Dana Whitfield accountable for AI security. Several AI systems are in use, but there is no AI policy, no defined roles and no agreed scope. What should Dana do FIRST?
From module 1B · AI strategy, policy & procedures
1. Keystone has an approved AI governance charter but no AI-specific documentation. Teams are asking for rules on using GenAI, onboarding models and deploying agents. Which should be developed FIRST?
From module 1C · AI asset & data life cycle
1. Internal audit asks Keystone for evidence of how AI risk is managed. Dana's team can name five AI systems but cannot say which data, models, indexes or credentials each uses. What should Dana do FIRST?
157 more questions like these are waiting inside.
What's inside
The whole ISACA AAISM exam in one guide: all three domains and thirteen subdomains of the June 2025 outline, taught the way ISACA tests them, from the manager's chair. AI governance and program management, AI risk, threat and supply chain management, and the architecture, life cycle, data, safety and monitoring controls that secure AI in production, followed through one insurer as it secures a GenAI claims assistant, a fraud model and an AI agent.
- 13 modules, one per subdomain, covering all 3 domains (1A–3E)
- 160 exam-style questions, half of them BEST/FIRST/MOST scenarios
- Explanations that say why every wrong option is wrong
- 26 worked scenario workshops in ISACA's manager-first style
- Attack walk-throughs: prompt injection, poisoning, model extraction, agent abuse
- NIST AI RMF, ISO/IEC 42001, EU AI Act, OWASP LLM Top 10 and MITRE ATLAS mapped to the outline
- 283-page downloadable PDF for offline study and printing
- Lifetime updates as the exam evolves
The modules, mapped to the objectives
- 1A12 Qs
Stakeholders, frameworks & regulation
Stakeholder considerations, industry frameworks, and regulatory requirements
Stakeholder analysis & affected partiesGovernance vs. management (EDM)AI governance charter & RACINIST AI RMF, ISO/IEC 42001, OECDEU AI Act roles and risk tiersGDPR Art. 22, DPIA & impact assessments - 1B12 Qs
AI strategy, policy & procedures
AI-related strategies, policies, and procedures
AI security strategy & roadmapPolicy, standard, procedure, guidelineAI acceptable use policyUse-case and model intakeExceptions & compensating controlsAI literacy & role-based training - 1C12 Qs
AI asset & data life cycle
AI asset and data life cycle management
AI asset types & discoveryAI inventory / model registryDerived-data classificationProvenance vs. lineageModel cards, datasheets, AI-BOMRetention, erasure & retirement - 1D12 Qs
AI security program management
AI security program development and management
Hub-and-spoke operating modelKPI vs KRI vs KCIMetric thresholds & actionsLLM gateway / AI firewallAI-SPM & model scanningIntegrated management system - 1E12 Qs
AI incident response and continuity
Business continuity and incident response
AI incident taxonomyIndirect prompt-injection playbookKill switch levelsModel rollback prerequisitesGDPR & EU AI Act clocksDegraded modes & AI BIA - 2A12 Qs
AI risk assessment & thresholds
AI risk assessment, thresholds, and treatment
Risk appetite vs. tolerance vs. thresholdKey risk indicators (KRIs) for AIALE, SLE, ARO and FAIR rangesResidual risk and risk acceptanceAI impact assessment (ISO/IEC 42005, FRIA, DPIA)Reassessment triggers - 2B12 Qs
AI threats & vulnerabilities
AI threat and vulnerability management
OWASP Top 10 for LLM Applications (2025)MITRE ATLASNIST AI 100-2 attacker goalsIndirect prompt injection & excessive agencyMembership inference & model extractionAI red teaming & attack success rate - 2C12 Qs
AI vendor & supply chain
AI vendor and supply chain management
Vendor tiering for AIAI contract addendum clausesShared responsibility for model APIsModel supply chain & unsafe serializationAI-BOM and model cardsFourth-party & concentration risk - 3A13 Qs
AI security architecture
AI security architecture and design
Trust boundaries in AI systemsIndirect prompt injectionAI gatewayGuardrail placement layersPermission-aware retrievalLeast agency & delegated identity - 3B13 Qs
AI life cycle security
AI life cycle (e.g., model selection, training, and validation)
Open vs closed weightsModel provenance & AI-BOMPickle deserialization riskModel registry & signingValidation & red-team gatesData, concept & prediction drift - 3C13 Qs
Data management controls
Data management controls
Data provenance & lineageDerived data classificationPseudonymization vs. anonymizationDifferential privacy & epsilonData poisoning & backdoorsPermission-aware retrieval - 3D12 Qs
Privacy, ethics, trust & safety
Privacy, ethical, trust, and safety controls
Human-in-the-loop vs. on-the-loopAutomation biasFairness metrics & four-fifths ruleSHAP, LIME & counterfactualsGrounding & confabulationPrivacy-enhancing technologies - 3E13 Qs
Security controls & monitoring
Security controls and monitoring
Input & output guardrailsAI gatewayExcessive agency (LLM06)Unbounded consumption (LLM10)KPI vs. KRIAI security posture management
Same exam. Two very different months.
Studying without a plan
- Re-reading the same chapter because you’re not sure what matters
- Booking the exam, then pushing it back. Twice.
- Walking out unsure, and paying to sit it again
Studying with Skillthropic
- Every domain of the AAISM outline, in the order the exam lists it
- 160 practice questions that show you exactly where you stand
- Booking the exam because you’re ready, not because the date arrived
Questions, answered
Do I need an account to buy?
No. Checkout is a single Stripe form: email and card, about 30 seconds. We create your access from your checkout email automatically and sign you in the moment payment completes.
Is this up to date with the real AAISM exam?
Yes. The guide is mapped module-by-module to the official ISACA AAISM objectives (1A–3E), and lifetime updates are included, so as the exam evolves your guide does too.
What exactly do I get?
Instant access to the interactive online guide with all 160 practice questions, plus a 283-page PDF you can download, print, and keep forever.
What if it isn't for me?
Every purchase comes with a 30-day money-back guarantee. Email us and we'll refund you, no hoops.
Who wrote it?
Chris Rees, a professional information technologist with 25+ years in IT and the author of 55 certification courses published on Pluralsight, rated 4.6/5 across 2,007 ratings.
Be ready for the whole AAISM exam, for $79
Instant access, lifetime updates, and a 30-day money-back guarantee. The only risk is walking into the exam without it.
Get the guide