How hard is the AAISM exam? Hard in one place and fairly forgiving everywhere else. You sit 90 multiple-choice questions in 150 minutes across three domains, and ISACA will not let you register at all unless you already hold an active CISM or CISSP. That gate is the single most important thing about the difficulty, because it means the exam can assume you know how to run a security program and can spend its hardest questions elsewhere. It spends them on Domain 3, AI Technologies and Controls, which is 38 percent of the paper.
The second half of an honest answer is that nobody can tell you a pass rate. ISACA does not publish one for the AAISM, the exam only launched on 19 August 2025, and the certified population is too small and too new for a reliable informal figure to have formed. Anyone quoting you a percentage made it up. What is knowable is the format, the scoring model, the domain weights, and where your existing credentials stop helping you. That last one is the useful part, so most of this post is about it.
Who ISACA lets sit this exam, and why it changes the question
The AAISM prerequisite is an active CISM or CISSP. Not one of a long list of accepted credentials, not a work-experience route, not a waiver. Two credentials, and they have to stay active: AAISM maintenance requires you to submit proof that the underlying certification is still in good standing. The full eligibility picture is in the AAISM requirements and eligibility rules.
That narrowness is deliberate. ISACA's AI risk credential, AAIR, carries a wide prerequisite list with a published directory of qualifying designations. AAISM has nothing of the kind anywhere on its pages. The effect is that everyone in the room on exam day has already passed a serious security management exam and has years of program work behind them.
So the usual difficulty question, "can I handle this material", is the wrong question here. You can handle most of it already. The real question is narrower: which parts of an AI security exam does a CISM or CISSP actually prepare you for, and which parts is it silent on.
What your CISM or CISSP actually buys you
Quite a lot, but in shape rather than in substance. Look at what Domains 1 and 2 contain and you will recognize the skeleton of every security management exam you have taken.
Domain 1, AI Governance and Program Management, at 31 percent, runs through stakeholder mapping, industry frameworks, regulatory obligations, strategy and policy, asset and data lifecycle management, program development, metrics and reporting, business continuity, and incident response. You have done every one of those. What changes is the object they point at. Your asset inventory now has to include models, training datasets, pipelines, prompts, embeddings and inference endpoints, and if any of those are missing the inventory is incomplete in a way that breaks classification, recovery scoping and incident scoping downstream. Your incident taxonomy has to accommodate data poisoning, model compromise, prompt injection and harmful output. Your framework shelf gains NIST AI RMF and ISO/IEC 42001 next to the ISO/IEC 27001 you already use.
Domain 2, at 31 percent, is the same story. Risk assessment, thresholds, treatment, threat and vulnerability management, vendor and supply chain management: all familiar headings. The new content underneath them is that AI risk behaves differently. Models are non-deterministic, they drift, they depend on data you may not control, and they are opaque in ways an application is not. The reference catalogs are new too, and the exam expects you to know which is which: the OWASP Top 10 for LLM Applications is a catalog of weaknesses, while MITRE ATLAS is a catalog of adversary behavior. Provenance work extends to model and data bills of material rather than software ones.
Call it 62 percent of the paper where your existing discipline transfers and only the vocabulary is new. That is a genuine advantage, and it is why the AAISM is a shorter study project than the CISM was.
Where the transfer stops
Domain 3 is where it stops. At 38 percent of a 90-question exam, that is somewhere around 34 questions riding on AI technologies and controls, and very little of it is reachable from security management experience alone.
Here is what sits inside it, from ISACA's own sub-topics: AI security architecture and design; the AI life cycle covering model selection, training and validation; data management controls; privacy, ethical, trust and safety controls; and security controls and monitoring. Written out that way it still sounds like governance. It is not. Consider what the questions have to be about.
Model selection is a security decision with three axes you have probably never had to weigh: build versus buy, open weights versus closed, and hosted API versus self-hosted artifact. Each combination hands you a different problem. A hosted foundation model transfers infrastructure burden to a provider but sends every prompt outside your control. An open-weight model you host yourself gives you the serving stack but makes you the inheritor of whatever was baked into the weights during someone else's pre-training, and lets an attacker study the same model offline. There is no default correct answer, only a fit to what your organization can actually govern.
Training and validation carry a distinction the exam genuinely cares about. Validating a model in the data science sense means measuring accuracy against a held-out test set. Validating model integrity means proving the artifact in production is the one the approved training run produced, which is a cryptographic hash recorded at training time and recomputed at every load. Both are required, they are different activities, and a candidate who has only ever thought about model quality will pick the wrong option.
Adversarial machine learning is new surface area for almost everyone. Evasion attacks feed a model an input a human would read correctly but the model misclassifies, and detecting them at runtime means watching confidence calibration, input distance from the training distribution, and disagreement between models rather than looking for anything malformed. Extraction attacks query a model methodically to build a shadow copy, and their signature is volume plus unnaturally uniform timing plus systematic coverage of the input space.
Data management controls go further than access control and encryption, because the leakage path in an AI system runs through the model's designed function. A model can be queried into revealing what was in its training data even when nobody ever touched the data store. That is why privacy-preserving techniques are on the syllabus, and why the exam treats them as pre-training design decisions. Differential privacy trades accuracy for a formal bound on what any single record can leak, and the budget has to be set before training. Federated learning keeps raw data with its holders but still leaks through gradients and still lets a malicious participant poison the aggregate. Neither can be bolted on after a privacy concern surfaces.
Monitoring is the last piece and the one that looks most familiar while being least so. You know how to run detection and response. What is new is the AI telemetry that feeds it: drift detection against a deployment baseline, where a sudden shift in input distribution is not only a quality problem but a possible sign that somebody is mapping your decision boundary; behavioral baselines over refusal rates and confidence distributions; abuse patterns like jailbreak probing and output harvesting. The AAISM domains explained post breaks all three domains down in full.
Is 150 minutes enough for 90 questions?
Do the arithmetic once and it settles the pacing question. 150 minutes is 9,000 seconds, divided by 90 questions, which is 100 seconds each. That is enough to read a short scenario, discard two options, and think properly about the two that remain. It is not enough to reconstruct an unfamiliar concept from first principles on more than a handful of items.
Which tells you exactly where the clock hurts. Domains 1 and 2 will move quickly because you are ranking management actions, something you have done under time pressure before. Domain 3 will not, if you are still translating terms while you read. Every second spent remembering what k-anonymity protects against, or why gradient inversion matters, is a second not spent choosing between two plausible options. Vocabulary has to be automatic by exam day, and that is a drilling problem rather than a reading problem. The AAISM study plan turns the weights into a schedule.
What a 450 scaled score is, and what it is not
ISACA reports AAISM results on a scaled range of 200 to 800, with 450 required to pass. A scaled score is a conversion of your raw performance onto a common scale so that results from different versions of the exam carry the same meaning regardless of which version you happened to sit. It is not a count of questions answered correctly, and it is not a percentage of anything. You cannot work backwards from 450 to a number of items, and neither can anyone selling you a course.
One detail is worth more than it first appears. Your result report shows domain-level information, but ISACA states plainly that scoring does not use domain percentages, so those lines are informational only. There is no per-domain hurdle to clear. A weak domain line is diagnostic feedback for a retake, not a separate gate you failed. Plan your study by the blueprint weights because that is where the questions are, not because a domain can sink you on its own.
Why Domain 2 has two names
You will see Domain 2 called two different things, and both come from ISACA. The exam content outline page on isaca.org calls it "AI Risk Management". The official AAISM Exam Candidate Guide calls it "AI Risk and Opportunity Management", in the body text and again in its content-outline appendix.
They are the same domain, not two competing versions. The three sub-areas underneath are identical in both sources: AI risk assessment, thresholds and treatment; AI threat and vulnerability management; AI vendor and supply chain management. Domains 1 and 3 match exactly across both. We are not going to pick a winner, because ISACA has not. Study the sub-areas and ignore the title.
Does a one-year-old exam make preparation harder?
Yes, and this deserves to be counted as part of the difficulty rather than treated as an excuse. The AAISM launched on 19 August 2025. Mature ISACA exams have decades of circulating practice items, forum write-ups and accumulated mapping of which traps recur. The AAISM has almost none of that. Third-party question banks are thin, and the ones that exist have not been sat against often enough for anyone to know how representative they are.
That matters more on this exam than it would on a knowledge-recall test, because what Domain 3 asks for is judgment about controls you may never have implemented. Judgment installs through repetition against explained answers, and with a small pool of questions each one has to do more work for you. Our AAISM study guide was written for that shortage, teaching all three domains at the published 31/31/38 weighting with practice questions where every option is explained, including why the wrong ones are wrong.
What a failed attempt actually costs you
Worth knowing before you book, because it changes how early you are willing to sit.
You get four attempts in any rolling 12-month period. The waiting periods are 30 days after the first attempt, then 90 days, then 90 days again. Every attempt costs the full exam fee, with no discount for a retake, and the fee is nonrefundable and nontransferable. The AAISM exam cost and fees post has the current numbers and the eligibility-window rules.
There is a rescore, but read its scope carefully. It costs US$75, must be requested in writing within 30 days of your results, is performed by PSI, and is available only if you did not pass. It is not a general service you can use to check a passing score, and it is not an appeal about question content.
Putting a difficulty label on it
If you hold an active CISM or CISSP and you work in security management, the AAISM is a moderate project with one steep section. The exam is short, the syllabus is only three domains, the format is plain multiple choice with no labs or simulations, and roughly two thirds of the questions land on reasoning you already do for a living. That is a real head start, and it is why this exam is not the mountain the CISM was.
The steep section is Domain 3, and it is steep because it is genuinely new rather than because it is badly written. Model selection trade-offs, secure training and integrity validation, adversarial machine learning, data and privacy controls, and AI monitoring are not things a security management career teaches you by accident. Give Domain 3 the largest share of your hours, get the vocabulary to the point where it costs you no reading time, and confirm the current format and fees on ISACA's own AAISM page before you register. The AAISM certification overview covers the credential end to end, and if you are still choosing between the two AI credentials, AAIA versus AAISM sets them side by side.
FAQ
What is the AAISM pass rate?
ISACA does not publish pass rates for the AAISM, and the exam is too new for a dependable community figure to exist. Any percentage you find quoted online was invented by whoever posted it, and ISACA's own guidance warns candidates about training providers who promise pass rates. Judge your readiness against the published facts instead: the 31/31/38 domain weights, the 90-question and 150-minute format, and the 450 scaled pass mark.
What score do you need to pass the AAISM?
450, on a scaled range that runs from 200 to 800. Because the score is scaled rather than raw, it does not correspond to a number of questions answered correctly and cannot be converted into one. Your result report will show domain-level information, but ISACA states that scoring does not use domain percentages, so those lines are diagnostic feedback rather than separate hurdles.
Which AAISM domain is the hardest?
Domain 3, AI Technologies and Controls. It is the largest at 38 percent, around 34 questions on a 90-question paper, and it is the one your CISM or CISSP did least to prepare you for. Model selection, secure training and validation, adversarial machine learning, data management controls, privacy-preserving techniques and AI monitoring are new surface area for most security managers, and there is no route through the exam that avoids them.
Is the AAISM harder than the CISM?
They are hard in different ways, and the AAISM is the smaller project of the two. The CISM covers four domains of security management with a long exam and an enormous body of study material behind it. The AAISM is three domains and 90 questions, but it assumes everything the CISM taught you and then adds technical AI content with far less practice material available. What the CISM exam covers sets out the foundation the AAISM takes for granted.
Do I need a technical AI background to pass the AAISM?
No, and the exam is not written for engineers. It asks what a security manager should require, govern, verify and monitor, not how to implement any of it. What you cannot do is skip the technology, because Domain 3 questions turn on knowing what a control actually does and what it fails to do. Learn the mechanisms well enough to choose between them, then drill explained questions until the management decision comes first.
Looking for a plain-English AAISM guide? ISACA AAISM: Simply Certified Study Guide covers all three domains at the published weighting, from the AI security manager's lens, with every practice answer explained.
Simply Certified is an independent publisher. AAISM, CISM and ISACA are trademarks of ISACA. Our books are independent study material and are not affiliated with, endorsed by, or sponsored by ISACA.