Learning Hub › ISACA AAISM Track › AAISM Lab
Learn by playing · All 3 domains
AAISM Lab
AI security management is easier to understand when you try it. In this lab you classify AI systems under the EU AI Act, map work to the NIST AI RMF, name LLM and adversarial ML attacks, defend an AI agent against prompt injection, and tune differential privacy. A manager-mindset trainer, a quiz and flashcards round it off. Every activity earns XP and badges. Your progress is saved in this browser only.
The exam at a glance
AAISM (Advanced in AI Security Management) is ISACA's AI credential for security managers who already hold CISM or CISSP. It has three domains. The bars show how much of the exam each one carries. Click a domain to jump to its mini-labs.
Questions
90
Time
150 min
Scoring
200–800
Pass mark
450
Prerequisite
An active CISM or CISSP certification. AAISM builds on that security management base and adds the AI layer.
Domain names and weights: ISACA AAISM Exam Content Outline. Question count, time and pass mark can change, so check ISACA's candidate information before you book.
Domain mini-labs
Two hands-on challenges per domain. Finish a lab to earn its badge and 50 XP. Every answer explains itself, and the full study notes are in the AAISM track.
Think like an AI security manager
Like CISM and CISSP, AAISM rewards the manager's answer: understand the business and the risk first, then policy and governance, then technology. Security advises; the business owner decides within the risk appetite. Watch for FIRST, BEST and MOST.
Quiz arena
Ten questions per run, drawn from all domains or the one you pick. Score 70% or more to earn the Arena badge. (That is a practice target, not the exam's scaled pass mark.) Each new question you get right is worth 10 XP.
Practice questions written for this site. They are not official ISACA items.
Flashcards
Flip a card, then be honest. Got it moves it up a box and it comes back less often; Again sends it to box 1. This is the Leitner system: a simple form of spaced repetition.
Sources & further reading
- ISACA AAISM Exam Content Outline
The three domains, their weights and subtopics.
- NIST AI RMF 1.0 (NIST AI 100-1) and the Generative AI Profile (NIST AI 600-1)
GOVERN, MAP, MEASURE, MANAGE: the basis of the D1 framework lab.
- EU AI Act: Regulation (EU) 2024/1689
Article 5 (prohibited practices), Annex III (high-risk uses), Article 50 (transparency).
- ISO/IEC 42001:2023: AI management systems
The certifiable AIMS standard.
- OWASP Top 10 for LLM Applications (2025)
The categories used in the D2 LLM threat lab.
- MITRE ATLAS
Adversary tactics and techniques against AI systems.
- NIST AI 100-2 E2025: Adversarial Machine Learning
Taxonomy of evasion, poisoning, privacy and extraction attacks.
Keep going: read the full domain notes in the AAISM track, try the CISSP Lab, or explore Threat Intel & MITRE.