AAISM knowledge map

AAISM is ISACA’s AI-security credential for people who already hold an active CISM or CISSP — it layers AI governance, AI risk management, and AI controls on top of that security-management foundation. This map points each of ISACA’s three job practice domains to the guidebook lessons that teach the underlying material — AI governance and risk frameworks, threat modeling AI systems, controls for the AI lifecycle. The exam is paid; the lessons are free. This map covers AAISM only: ISACA’s separate AI credentials for audit (AAIA) and risk (AAIR) are listed separately. Domain titles are ISACA’s; everything else is the guidebook’s own words.

Published 2026-10-09 · generated from the lesson data · 3 of 3 domains have a lesson

ISACA’s rule, stated once: only security professionals who hold an active CISM or CISSP are eligible to pursue AAISM. The lessons teach the AI-specific material; they do not confer the credential and do not replace the prerequisite.

ISACA runs three separate Advanced AI credentials: AAIR (Advanced in AI Risk), AAISM (Advanced in AI Security Management), and AAIA (Advanced in AI Audit). This map covers AAISM only.

This map follows ISACA’s AAISM exam content outline as published at isaca.org, verified 2026-10-10: a 90-question exam across three job practice domains.

Domain	Title	Lessons
1	AI Governance and Program Management	Governing AI, Running a security program, Security policy, standards, procedures, and guidelines: the document hierarchy
2	AI Risk Management	Risk assessment as a worked case, Threat modeling AI systems, Threat modeling concepts and methodologies: choosing how to think about what can go wrong, Supply chain risk management: trusting what you didn't build
3	AI Technologies and Controls	How LLM applications are built and where they are attacked, AI attacks and defenses in the build pipeline, AI supply chain security, Data security controls: protecting data at rest, in transit, and in use, Logging and monitoring operations: deciding what gets watched, and by whom

Domain

Title

Lessons

AI Governance and Program Management

Governing AI, Running a security program, Security policy, standards, procedures, and guidelines: the document hierarchy

AI Risk Management

Risk assessment as a worked case, Threat modeling AI systems, Threat modeling concepts and methodologies: choosing how to think about what can go wrong, Supply chain risk management: trusting what you didn't build

AI Technologies and Controls

How LLM applications are built and where they are attacked, AI attacks and defenses in the build pipeline, AI supply chain security, Data security controls: protecting data at rest, in transit, and in use, Logging and monitoring operations: deciding what gets watched, and by whom

AAISM knowledge map

The domains