To get the AAISM you need one thing before anything else: an active CISM or an active CISSP. That is the entire prerequisite list. Not a long roster of accepted designations, not a work-experience route, not a waiver for people who have been securing models since before ISACA had a credential for them. If you hold neither of those two certifications today, you cannot register for the AAISM exam today, and relevant work history does not change that.
The rest of the requirements are ordinary by comparison. ISACA expects security or advisory experience and demonstrated expertise with AI systems alongside the qualifying credential, you pay a one-time US$50 application processing fee on top of the exam registration, you have five years from passing the exam to apply for certification, and you agree to the ISACA Code of Professional Ethics. Once certified, upkeep is 10 CPE hours a year and 30 across each three-year reporting period, an annual maintenance fee of US$20 for members or US$35 for nonmembers, and standing proof that the CISM or CISSP underneath you is still active. This post takes each of those in turn, starting with the gate, because for most readers the gate is the whole answer.
The two credentials that open the door
An active CISM, or an active CISSP. Either one on its own is enough, and you do not need both. Everywhere ISACA states AAISM eligibility, it states the same two, and it has stated it that way since the credential launched in August 2025.
That pairing tells you who the exam was written for. CISM is ISACA's own security management certification, and CISSP is the broad security credential most managers outside the ISACA world already carry, so between them they cover roughly one professional profile: somebody who owns a security program rather than somebody who builds systems. The AAISM assumes that background and tests what changes when the systems inside the program are AI systems. For a sense of what the exam does with that assumption, how hard the AAISM exam is works through which parts of your existing discipline transfer and which parts stop at the door.
If you are working toward the prerequisite rather than holding it, the ISACA side is covered in what the CISM exam is, and the harder half of it, the verified work experience, in CISM requirements and experience. Plan on that being a project of its own. CISM is a full certification with its own experience rules and its own application, not something you clear in the run-up to an AAISM sitting.
Why CISA, CRISC and CGEIT will not get you in
The answer is no, and it is worth being blunt about it. A CISA does not qualify you for the AAISM. Neither does a CRISC, a CGEIT, a CDPSE, an accounting or auditing designation, or an AI certificate. Only CISM and CISSP appear on ISACA's AAISM eligibility statements.
It is a fair thing to be confused about, because the sibling credentials in this family do not work the same way. ISACA's AI risk credential, AAIR, carries a wide prerequisite list, described in ISACA's own announcement as one of 25 qualifying certifications, and its credential page links out to a directory of global designations that count toward it. The AI audit credential, AAIA, has widened its own list more than once since launch. AAISM has no such list and no such directory, anywhere on any of its pages.
That contrast is the useful part. ISACA clearly knows how to write a broad prerequisite when it wants one, and for AAISM it did not write one. Treat the short list as a deliberate scope decision rather than an oversight waiting to be corrected, and plan against the rule as published. If what you hold is a CISA, your route into this family is the audit one: AAIA requirements and eligibility sets out what that exam accepts, and AAIA versus AAISM compares the two credentials on scope rather than on entry rules.
Does the prerequisite have to stay active?
Yes, and this is the part candidates most often miss. The qualifying credential is a standing condition, not a one-time ticket you hand over at the door. ISACA's AAISM maintenance process requires proof that your CISM or CISSP is still active, which means the AAISM cannot outlive the certification it was layered on.
Two practical consequences follow. The first is scheduling: you are now running two maintenance obligations on two separate calendars under two separate sets of rules, and the AAISM one is the smaller of the two. The second is risk. If you were already thinking about letting a CISM lapse because you had moved on from the work it covers, understand that the decision now takes the AAISM with it, and nothing in the renewal process will frame it that way for you. Decide which credential you intend to keep for the long term before you spend on this exam, not after.
Is there an experience requirement for the AAISM?
Not a numeric one. ISACA describes the AAISM candidate as holding security or advisory experience together with AI-systems expertise, and that description sits alongside the prerequisite credential rather than substituting for it. What it does not do is set a year count.
Say that plainly, because ISACA's flagship certifications do set one and candidates arrive expecting the same structure. CISA asks for five years of verified information systems auditing, control, or security work. CDPSE asks for three years in privacy. AAISM publishes no comparable figure and no verification form built around one, so there is no number to count toward and nothing for a manager to sign off. Read the experience language as a portrait of who the exam was written for. The requirement that is actually enforced at registration is the credential.
What happens between passing the exam and being certified
Passing is not the same as being certified, and the window between the two is longer than most people assume. You have five years from the date you pass the AAISM exam to apply for certification. Miss that and the pass no longer supports an application.
One rule inside that window catches people out. For as long as your application window is open, you are barred from retaking the same exam. You cannot sit AAISM again to refresh a result or tidy anything up about it, so those five years are a deadline to finish the application rather than a period you can restart at will.
The application also carries the one-time US$50 processing fee, which does apply to AAISM and is separate from the exam registration. Certification then binds you to the ISACA Code of Professional Ethics, which applies for as long as you hold the credential rather than being a form you sign once. Read the current wording on ISACA's own ethics page before you apply. The full money side, including registration, retake pricing, and the eligibility window on the exam itself, is in AAISM exam cost and fees.
How much CPE does the AAISM require?
10 hours a year, 30 across each three-year reporting period, and all 30 have to align with the AAISM exam content outline.
If you hold a CISM, compare that against what you already do:
| Requirement | AAISM | CISM and ISACA's mainstream certifications |
|---|---|---|
| Annual minimum | 10 hours | 20 hours |
| Three-year total | 30 hours | 120 hours |
| Must match the exam content outline | All 30 | 90 of the 120 |
The hour count is the headline, since a quarter of the load is a real saving. The alignment rule is the catch. On a CISM you have 30 hours of slack in each cycle for general professional development, and most people fill it without thinking: a conference track on something adjacent, a vendor briefing, a management course. On the AAISM there is no slack at all. Every hour you report has to map to the outline, so general security training does not count toward it, and neither does AI work sitting outside what the three domains cover.
In practice that means choosing CPE against the outline rather than against your calendar. Ten hours a year is not much once you know what qualifies: AI governance and program management, AI risk management (published in ISACA's own candidate guide as AI risk and opportunity management), and AI technologies and controls. The AAISM domains explained breaks all three down sub-area by sub-area, which is the list to hold against any course description before you book it. The same outline shapes the exam, which is why the ISACA AAISM Simply Certified Study Guide is built at the published 31/31/38 weighting rather than by topic convenience.
When does your first CPE year actually start?
Later than you probably think, and this one is confirmed rather than inferred. Your annual and three-year reporting periods begin on 1 January of the year after you certify. CPE you earn during the calendar year in which you certify does not need to be reported at all.
So if you certify in March, you are not scrambling for 10 hours by December. Your first reporting year opens the following 1 January, and the three-year cycle runs from that same date. The study you did on the way to the exam, and anything you pick up in the months right after, sits outside the count entirely. That is a small piece of breathing room and a common source of double-counting, so log hours against the correct year from the start.
What does maintenance cost, and when is the fee due?
US$20 a year for ISACA members, US$35 for nonmembers.
There is one detail here that is genuinely useful and not widely known. However many ISACA Advanced certifications you hold, the total annual maintenance across all of them is US$20 or US$35. It is not charged per credential. Holding AAIA and AAISM together costs the same annual maintenance as holding one of them, and adding AAIR on top of both still does not move the figure. If you were pricing a second Advanced credential on the assumption that the yearly line item doubles, it does not.
The timing is stated less cleanly, and we are not going to paper over it. ISACA describes the maintenance fee as due annually by 1 January and required to renew you through the upcoming calendar year, so it behaves as an annual renewal keyed to the calendar year rather than to your certification anniversary. ISACA's own CPE policy document, meanwhile, puts both fee payment and CPE reporting at 31 December. Those two statements are a day apart and they come from the same organization. Confirm your own dates in your ISACA account and on ISACA's AAISM maintenance page rather than working a first-year total out of anything you read here, this post included.
What to have in place before you register
Run the list in order, because the first item decides whether the rest matter.
An active CISM or CISSP that you intend to keep active indefinitely. Security or advisory experience plus real exposure to AI systems, which nobody verifies but which the questions assume. The exam fee and the US$50 application processing fee. A plan to apply for certification well inside the five-year window. And a clear-eyed view of the annual upkeep: 10 outline-aligned CPE hours, US$20 or US$35, and proof that the credential underneath is still in good standing.
If all of that holds, the next question is how long to give the material, which the AAISM study plan answers, and the credential end to end is in the AAISM certification overview. Rules move, and this is a young credential, so confirm eligibility, fees, and CPE requirements on ISACA's own AAISM pages before you pay for anything.
FAQ
Can I take the AAISM exam without a CISM or CISSP?
No. Those two credentials are the only qualifying prerequisites ISACA lists for AAISM, and one of them has to be active when you register. There is no experience-based alternative and no waiver, so if you hold neither, the prerequisite is the exam to plan first.
Does a CISA or CRISC qualify me for the AAISM?
No, and neither does CGEIT, CDPSE, or an AI certificate. This surprises people because the sibling AAIR credential accepts a long list of qualifying designations and AAIA has widened its own list since launch, but AAISM has never published anything beyond CISM and CISSP. If you hold a CISA, the AAIA is the credential in this family built for your background.
What happens to my AAISM if my CISM lapses?
The AAISM depends on it. ISACA's maintenance process requires proof that your qualifying CISM or CISSP is still active, so the AAISM cannot be kept alive on its own once the credential underneath it goes. That makes the prerequisite an ongoing commitment rather than an entry condition.
How many CPE hours does the AAISM need each year?
10 hours a year and 30 across each three-year reporting period, with all 30 aligned to the AAISM exam content outline. That is a quarter of the mainstream ISACA hour requirement, but there is no general-development allowance, so unrelated security training does not count toward it. Reporting begins on 1 January of the year after you certify.
Does holding two ISACA Advanced credentials double the maintenance fee?
No. ISACA's AAISM maintenance page states that the total annual maintenance fee covering all of your ISACA Advanced certifications is US$20 for members or US$35 for nonmembers, however many you hold. AAIA and AAISM together cost the same yearly maintenance as either one on its own.
Cleared the prerequisite and ready for the exam? ISACA AAISM: Simply Certified Study Guide teaches all three domains at the published 31/31/38 weighting, from the security manager's govern-and-control lens, with two full-length practice exams and every answer explained.
Simply Certified is an independent publisher. AAISM, AAIA, AAIR, CISM and ISACA are trademarks of ISACA. Our books are independent study material and are not affiliated with, endorsed by, or sponsored by ISACA.