CISA, CISM, and AAISM all come from ISACA, but they validate different professional responsibilities. CISA is centered on information-systems audit, controls, governance, operations, resilience, and protection of information assets. CISM is centered on leading an information-security program through governance, risk management, program management, and incident management. AAISM is a specialist extension for experienced security managers who need to govern and manage security risk around enterprise AI.
The credentials overlap because auditors, security managers, and AI-security leaders all care about risk and controls. The difference is the decision each role is expected to make. A CISA professional asks whether controls and processes are designed and operating effectively. A CISM professional decides how the security program should be governed, funded, prioritized, and managed. An AAISM professional applies security-management discipline to AI-specific governance, risk, technologies, and controls.
AAISM also has an unusually important eligibility rule: candidates must hold an active CISM or CISSP credential. That makes it an extension of established security-management experience rather than a general first AI certification.
CISA is the assurance lens
The current CISA exam contains 150 questions across five domains: Information System Auditing Process; Governance and Management of IT; Information Systems Acquisition, Development and Implementation; Information Systems Operations and Business Resilience; and Protection of Information Assets. The scope is broad because an auditor needs to evaluate technology in the context of organizational objectives and controls.
CISA practitioners plan audits, gather and evaluate evidence, test controls, assess governance, examine system-development and change practices, review resilience, and evaluate security protections. Their job is not primarily to operate the control. It is to determine whether the control environment is appropriate, implemented, and producing the intended assurance.
That independence of viewpoint is the credential’s defining feature even when the auditor has deep technical knowledge.
CISM is the management and program-ownership lens
CISM uses four job-practice domains: Information Security Governance, Information Security Risk Management, Information Security Program, and Incident Management. It is designed for professionals who translate business priorities and risk into a security strategy and operating program.
That means CISM questions are often about prioritization, governance, ownership, policy, resources, metrics, risk treatment, program development, and response capability. A security manager may not configure every control personally, but is accountable for whether the organization has the right controls, people, processes, reporting, and escalation mechanisms.
ISACA requires five years of professional information-security management experience across relevant CISM practice areas for certification, although candidates can sit the exam before all certification experience requirements are complete.
The November 2026 CISM update is close, but not current yet
As of October 4, 2026, ISACA has announced an updated CISM exam content outline that becomes effective on November 3, 2026. Updated preparation materials became available in September, but candidates testing before the effective date are still taking the current exam. The four domain names remain the same while weightings and content emphasis change, including more explicit treatment of enterprise and information-security architecture.
This timing matters because study materials can be newer than the exam being delivered. Candidates should match their preparation to their scheduled date rather than assuming the most recently published book automatically describes today’s live form.
The broader role distinction does not change: CISM remains the credential for managing the security program.
AAISM adds AI-specific security management to an established foundation
ISACA Advanced in AI Security Management is designed for professionals who already hold an active CISM or CISSP certification and have security or advisory experience plus some familiarity with assessing, implementing, or maintaining AI systems. The exam contains 90 questions across AI Governance and Program Management, AI Risk Management, and AI Technologies and Controls.
The role is not “AI engineer with a security badge.” It is security management applied to AI. Candidates need to understand policy, governance, data lifecycle, AI-specific risk, incident handling, human oversight, technology controls, model and system threats, and how AI adoption should fit the enterprise security program.
AAISM is therefore most useful when an experienced security leader is being asked to approve, govern, or secure AI systems across the organization.
The same AI system creates three different professional questions
Consider a company deploying an internal generative-AI assistant that can retrieve sensitive documents and call business tools. A CISM-oriented leader asks how the use case fits security strategy, who owns risk, what policies are needed, how the program is resourced, and how incidents will be governed. An AAISM professional goes deeper into AI-specific threats, data and model risks, human oversight, tool permissions, monitoring, and AI control design.
A CISA-oriented auditor asks whether the governance and controls can be independently evaluated: are access rules implemented, is evidence retained, are risk assessments complete, are changes controlled, are incidents tracked, and does the actual system operate as documented?
All three can work on the same initiative without duplicating one another because their accountabilities differ.
Audit independence separates CISA from CISM most clearly
A security manager may design or sponsor a control, establish the policy, assign ownership, and accept residual risk. An auditor should evaluate whether that control and the surrounding governance are effective, using sufficient evidence and professional judgment. Combining those responsibilities carelessly can weaken independence because a person ends up auditing decisions they made themselves.
That distinction also changes exam reasoning. CISM often asks what management should do to align security with business risk. CISA often asks what evidence, testing, or governance conclusion is appropriate. Both care about risk, but one owns the program and the other evaluates it.
Candidates moving between the credentials need to adjust perspective, not just memorize another set of domains.
Risk management is the common language across all three
CISA evaluates whether enterprise and technology risks are identified and controlled. CISM builds and operates the risk-management process within the security program. AAISM extends that process to AI-specific uncertainty such as model behavior, data exposure, adversarial use, third-party models, automated actions, bias, explainability, and changing regulatory expectations.
Strong practitioners understand that risk is not reduced by adding controls indiscriminately. Controls have cost, operational impact, and residual limitations. The professional task is to identify relevant threats and consequences, choose proportionate treatment, assign ownership, and monitor whether the treatment remains effective.
That shared reasoning is why the credentials complement one another even though the job roles remain distinct.
Experience requirements should shape the route you choose
CISA certification requires substantial professional experience in information-systems auditing, control, or security. CISM requires substantial information-security management experience. AAISM requires an active CISM or CISSP credential in addition to passing its own exam and meeting ongoing maintenance requirements.
Those rules make the career sequence more constrained than many vendor certifications. Someone early in cybersecurity can study the bodies of knowledge, but the full credentials are designed to represent professional practice rather than only exam performance. AAISM in particular is intentionally positioned after established security-management credibility.
The ISACA certifications portfolio is therefore best read in terms of professional responsibility and experience, not only topic interest.
Choose CISA for assurance, CISM for program leadership, and AAISM for AI-security management
CISA is the clearest fit if your work involves audit planning, control assessment, evidence, governance review, system-development assurance, operations and resilience review, or independent evaluation of information security. CISM is the clearer fit if you own security governance, risk decisions, program strategy, resources, metrics, or incident-management capability.
AAISM becomes relevant after that security-management foundation when AI systems are a material part of enterprise risk and you need specialized governance and control knowledge. It is not a replacement for CISM; ISACA explicitly builds it on top of an active CISM or CISSP credential.
A governance initiative illustrates the separation well. Suppose an organization deploys an AI-enabled customer-service platform. A CISM-oriented leader may define security governance, risk treatment, program resources, incident responsibilities, and how the platform fits enterprise policy. An AAISM-oriented specialist adds deeper AI-specific questions about model and data risk, lifecycle controls, third-party models, misuse, monitoring, human oversight, and the security implications of how the AI system is built and operated. A CISA-oriented auditor asks whether the resulting governance and controls are designed appropriately, implemented as claimed, evidenced, and operating effectively.
The evidence each role values also differs. Auditors need traceable criteria, sampling, documentation, control evidence, findings, and an independent basis for conclusions. Security managers need risk information, priorities, ownership, resource decisions, program measures, and incident readiness. AI-security managers need those management capabilities plus evidence specific to AI technologies and controls: data lineage, model access, evaluation, monitoring, change governance, supplier dependencies, and mechanisms that constrain unsafe or unauthorized behavior. The overlap is real, but the professional objective is not identical.
The announced CISM exam change in November 2026 is a good reminder to separate certification lifecycle from role identity. Domains and weights can be refreshed as practice changes, while the credential’s central purpose remains security management. Candidates testing before the effective date should prepare to the current outline; candidates testing on or after the change should use the new one. The same principle applies across ISACA credentials: verify the active exam content for your test date, but choose the credential by the work you want to be accountable for.
There is also no universal sequence in which CISA must precede CISM or vice versa. Professionals often accumulate the credentials in the order their careers create the required experience. An internal auditor moving into security leadership may earn CISA first and later add CISM. A security manager who becomes responsible for assurance or audit coordination may move the other direction. AAISM is different because ISACA explicitly requires an active CISM or CISSP, making it an additive specialization rather than an independent starting point. That prerequisite should be treated as a real eligibility constraint, not merely a suggested study order.
Choosing correctly means identifying the role you are expected to perform when difficult decisions have to be made.