TL;DR: ISACA’s AAISM (Advanced in AI Security Management) and IAPP’s AIGP (Artificial Intelligence Governance Professional) are both AI governance credentials, but they sit in different seats. AAISM is for security leaders who already hold an active CISM or CISSP, and ISACA’s own page lists three domains: AI Governance and Program Management (31%), AI Risk Management (31%) and AI Technologies and Controls (38%), across 90 questions. AIGP has no prerequisites, and reported details put it at 100 questions over three hours with four domains covering foundations, laws and frameworks, governing AI development and governing AI deployment. On cost, ISACA lists AAISM at US459formembersandUS599 for non-members, plus a US50applicationfee.AIGPisreportedatUS649 for members and US$799 for non-members, because IAPP’s page did not list fees. If you are a security manager, CISO or GRC lead with CISM or CISSP in hand, AAISM is the natural fit. If you work in privacy, legal, compliance or product governance without a security certification, AIGP is the one you can sit now. The decision map below sorts it out by job title.
The short version: this is not a choice between “better” and “worse.” It is a choice between a security-management credential that is gated by a prerequisite and a governance credential that is open to anyone.
Quick Facts
| Item | ISACA AAISM | IAPP AIGP |
| Full name | Advanced in AI Security Management | Artificial Intelligence Governance Professional |
| Issuer | ISACA | IAPP |
| Prerequisite | Active CISM or CISSP (ISACA’s page) | None (reported) |
| Experience guidance | Proven experience in security or advisory roles and some expertise assessing, implementing and maintaining AI systems (recommended, ISACA’s page) | None required (reported) |
| Exam questions | 90 (ISACA’s content outline page) | 100, of which 85 scored and 15 unscored (reported) |
| Exam duration | About 150 minutes (reported) | Three hours including an optional 15-minute break (reported) |
| Domains | 3: AI Governance and Program Management 31%, AI Risk Management 31%, AI Technologies and Controls 38% (ISACA) | 4: Foundations of AI Governance, Laws Standards and Frameworks, Governing AI Development, Governing AI Deployment and Use (reported) |
| Exam fee | US459members,US599 non-members, plus US$50 application fee (ISACA’s page) | US649members,US799 non-members (reported) |
| Passing score | Reported as 450 on a 200 to 800 scale. ISACA’s page does not state it | Reported as 300 on a 100 to 500 scale |
| Delivery | PSI test centers or remote proctoring (ISACA’s page) | Pearson VUE test centers or remote proctoring (reported) |
| Renewal | ISACA continuing professional education policy. Reported as 10 AI-focused CPEs per year, plus keeping CISM or CISSP active | Reported as 20 CPEs every two years |
Anything marked “reported” comes from third-party prep sites, not from the issuer’s own page. We could not open IAPP’s exam and fee pages, so every AIGP figure here is reported. Confirm each one before you pay.
The Seat Map: Which Credential Matches Your Job?
Most comparisons walk through exam features side by side and leave you to work out which one is yours. This guide starts with the seat you sit in.
| Your role | Better fit | Why |
| CISO or deputy CISO with CISM or CISSP | AAISM | Directly builds on the credential you already hold and focuses on securing AI systems |
| Security architect or security manager with CISSP | AAISM | The technologies and controls domain is the largest at 38% |
| GRC or risk lead with CISM | AAISM | You already qualify, and AI risk management is a full domain |
| Privacy officer or privacy counsel without a security credential | AIGP | No prerequisite, and the domains center on laws, standards and governance |
| Compliance manager building an AI policy program | AIGP | The laws, standards and frameworks domain matches the work |
| Product or program manager owning responsible AI | AIGP | Governing development and deployment maps to product lifecycle ownership |
| IT auditor assessing AI controls | Either, check your credentials | If you hold CISM or CISSP, AAISM is open to you. If not, AIGP is the open door |
| Security professional without CISM or CISSP | AIGP now, or earn CISM or CISSP first | AAISM is closed to you until you hold one |
| Someone who wants both a security and a governance view | AAISM first if eligible, then consider AIGP | The two overlap in governance but differ in emphasis |
The rule that decides most cases
AAISM is gated. If you do not hold an active CISM or CISSP, the choice is made for you, and the real question becomes whether to pursue one of those two first. If you do hold one, the question is whether your daily work looks more like securing systems or governing programs.
What ISACA Says About AAISM
This section uses only what ISACA’s pages state.
| Item | What ISACA says |
| Format | Computer-based, 90 questions (content outline page) |
| Domains | AI Governance and Program Management 31%, AI Risk Management 31%, AI Technologies and Controls 38% |
| Eligibility | Active CISM or CISSP required |
| Recommended background | Proven experience in security or advisory roles, plus some expertise assessing, implementing and maintaining AI systems |
| Exam fees | US459members,US599 non-members |
| Certification fee | US$50 application processing fee |
| Eligibility window | Six months from registration to take the exam |
| After passing | Five years to apply for certification |
| Delivery | PSI test centers worldwide or remotely proctored. Registration is continuous. Appointments can be booked 48 hours after payment, up to 90 days in advance |
| Regional note | Candidates in India, Mainland China and Hong Kong must use testing centers |
| Not stated on the pages we read | Duration, passing score and launch date |
Reading the domain weights
The largest domain is AI Technologies and Controls at 38%. That tells you the exam leans technical, not purely policy. The two governance and risk domains split the remaining 62% evenly. A security manager who already thinks in controls will recognize the shape, and a pure policy specialist may find the technology domain the steepest climb.
What We Found About AIGP
IAPP’s AIGP page, as we could read it, points to a body of knowledge and exam blueprint, a study guide, a candidate handbook and training, but does not list the exam format, fee or prerequisites on the page itself. So the figures in this section are reported by prep sites and flagged accordingly.
| Item | Reported detail |
| Issuer | IAPP |
| Prerequisites | None |
| Format | 100 multiple-choice questions, 85 scored and 15 unscored pilot items |
| Duration | Three hours including an optional 15-minute break (another summary lists about 165 minutes of testing time, which matches once the break is removed) |
| Scoring | 100 to 500 scale, 300 to pass |
| Case studies | About 30% of items are case study scenarios (one prep source) |
| Domains | Foundations of AI Governance. Laws, Standards and Frameworks. Governing AI Development. Governing AI Deployment and Use |
| Approximate weights | Foundations about 21%, Laws and Frameworks about 25%, Governing Development about 27%, Governing Deployment about 27% (one prep source, with question ranges of 16 to 20, 19 to 23, 21 to 25 and 21 to 25) |
| Fees | US649members,US799 non-members |
| IAPP membership | Reported at US$295 per year |
| Retakes | Reported as permitted after a seven-day wait |
| Validity and renewal | Reported as two years, with 20 continuing education credits |
| Delivery | Pearson VUE test centers or remote proctoring |
Where the AIGP sources disagree
| Point | Version A | Version B | How we treat it |
| Body of knowledge version | One prep source says version 2.0.1, effective February 2025 | Another says version 2.1, effective February 2, 2026 | We cannot tell which is current. Download the latest body of knowledge from IAPP before studying |
| Exam duration | Three hours | About 165 minutes | These can both be true if the three hours includes a 15-minute optional break. We report both |
| Whether the figures come from IAPP | Presented as facts | Not attributed to IAPP in the sources | Treat every AIGP number as unconfirmed until you check IAPP |
Where the AAISM sources disagree
| Point | ISACA’s page | A prep site | How we treat it |
| Eligibility | Active CISM or CISSP | CISSP or CISM “or equivalent” | We follow ISACA’s page. No “equivalent” is listed there |
| Exam duration and passing score | Not stated on the pages we read | About 150 minutes, 450 on a 200 to 800 scale | We report them as reported |
Side by Side: Where the Two Overlap and Where They Split
| Topic | AAISM | AIGP |
| Governance and program management | A full domain at 31% | Spread across foundations and the two governing domains |
| Risk | A full domain at 31% | Embedded in governance of development and deployment |
| Technology and controls | The largest domain at 38% | Not a named domain |
| Laws, standards and frameworks | Part of governance work, not a named domain | A named domain at about 25% (reported) |
| Development lifecycle | Not a named domain | A named domain at about 27% (reported) |
| Deployment and operation | Covered through controls and risk | A named domain at about 27% (reported) |
What this means in practice
AAISM asks, “How do you secure and manage risk in AI systems?” AIGP asks, “How do you govern AI across its life, and what do the laws and standards require?” A security leader will recognize AAISM’s questions as daily work. A privacy or compliance lead will recognize AIGP’s.
Cost: The Real Price of Each Path
The sticker prices hide a gap, because AAISM is gated by a prerequisite and AIGP is not.
| Cost item | AAISM | AIGP |
| Exam fee, member | US$459 | US$649 (reported) |
| Exam fee, non-member | US$599 | US$799 (reported) |
| Application or certification fee | US$50 | None reported |
| Total, member | US$509 | US$649 (reported) |
| Total, non-member | US$649 | US$799 (reported) |
| Prerequisite credential | Active CISM or CISSP | None |
Reading the table
- The totals are our arithmetic: AAISM member is US459plusUS50, and non-member is US599plusUS50.
- A non-member AAISM total of US$649 equals the AIGP member price, which is a coincidence worth knowing when you compare.
- The AAISM totals leave out the cost of CISM or CISSP, which you must already hold. If you do not, the true entry cost is far higher.
- Membership dues for ISACA were not on the pages we read, so the member fees above do not include them. IAPP membership is reported at US$295 per year. Compare membership costs before assuming a member price applies to you.
Fees change, and exam pages sometimes lag. Check each issuer’s current pricing before you book.
Renewal and Upkeep
| Item | AAISM | AIGP |
| Continuing education | ISACA’s continuing professional education policy applies. Reported as 10 AI-focused CPEs per year | Reported as 20 credits every two years |
| Dependency | Reported that you must keep CISM or CISSP active | None |
| Where you manage it | MyISACA | IAPP account (reported) |
AAISM ties you to a second credential. If you let CISM or CISSP lapse, the reported rule would put AAISM at risk too. That is worth a line in your career plan.
Preparing for Each Exam
AAISM study order
| Order | Domain | Why |
| 1 | AI Technologies and Controls (38%) | The largest domain and the least familiar for many governance-minded candidates |
| 2 | AI Risk Management (31%) | Builds on the controls vocabulary |
| 3 | AI Governance and Program Management (31%) | Most security managers already know program management. Study for the AI-specific parts |
If you hold CISM, your governance and risk knowledge carries over. If you hold CISSP, your technical breadth carries over. Study the domain that your credential covers least.
AIGP study order
| Order | Domain | Why |
| 1 | Foundations of AI Governance | Establishes vocabulary for the rest |
| 2 | Laws, Standards and Frameworks | A heavy domain with material that is new to many candidates |
| 3 | Governing AI Development | The largest block, reported at about 27% |
| 4 | Governing AI Deployment and Use | The other largest block, reported at about 27% |
Download the current body of knowledge and exam blueprint from IAPP first, since the version question above is unresolved.
A six-week outline for either exam
| Week | Focus | Output |
| 1 | Read the official outline or body of knowledge and take a baseline practice set | Domain-by-domain score |
| 2 | First domain | Summary notes |
| 3 | Second domain | Summary notes |
| 4 | Third domain (and fourth for AIGP) | Summary notes |
| 5 | Mixed practice under timed conditions | Error log |
| 6 | Weak-domain review and logistics | Exam-day checklist |
Our practice resources for AAISM are on our AAISM exam questions page, and our practice tests hub lists the rest of the catalog. Use practice sets to find gaps, and use the issuers’ own outlines to decide what to study.
Practice Scenarios
These are illustrations, not real people.
Scenario 1: A CISO with CISSP. She is building an AI security program. AAISM is open to her, the technology and controls domain matches her work, and her CISSP satisfies the prerequisite. She should start with AAISM.
Scenario 2: A privacy counsel with no security credential. He advises on AI regulation. AAISM is closed to him without CISM or CISSP. AIGP is open now and its laws and frameworks domain matches his work. He should start with AIGP.
Scenario 3: An IT auditor with CISA only. CISA is not CISM or CISSP, so AAISM is closed on ISACA’s stated eligibility. She should look at AIGP, or at earning CISM, and check ISACA’s page for any change to the prerequisite list.
Scenario 4: A GRC lead with CISM who also owns privacy. He qualifies for AAISM and also works on governance. He could pick either. If his employer is asking about security controls on AI, AAISM first. If the questions are about regulation and policy, AIGP first.
Scenario 5: A product manager responsible for responsible AI. She has no security credential and works with legal and engineering. AIGP’s development and deployment domains match her ownership of the product life cycle.
Choosing Between Them When You Qualify for Both
If you hold CISM or CISSP and could take either, three questions settle most cases.
| Question | If yes | If no |
| Is your daily work about securing AI systems and managing technical risk? | AAISM | Continue |
| Is your daily work about policy, law, ethics and program governance? | AIGP | Continue |
| Does your employer or client name one of them in job descriptions? | Take the named one | Take the cheaper one, then reassess |
A reader weighing the neighboring ISACA credentials may also find these useful: our CRISC vs CISM comparison covers CISM, one of the two credentials that opens the AAISM door, and our guide to CISSP vs CISM compares it with the other. For a broader map of security credentials, see our best cybersecurity certifications guide, and for audit and compliance paths see our overview of cybersecurity certification exams for audit and compliance. If privacy is your side of the work, our CIPT certification guide covers the IAPP technology credential.
We omit salary figures from this post. We did not find a source that isolates holders of these two new credentials from broader security and privacy roles, and a quoted average would mislead you.
What We Don’t Know Yet
We would rather list gaps than guess.
- IAPP’s own AIGP numbers. We could not read IAPP’s exam, fee and prerequisite pages, so every AIGP figure here is reported by a prep site.
- The current AIGP body of knowledge version. One source says version 2.0.1 from February 2025 and another says version 2.1 from February 2, 2026.
- AAISM duration and passing score. ISACA’s pages we read did not state them. The figures above are reported.
- AAISM launch date. ISACA’s page does not give one.
- Whether ISACA will broaden the prerequisite. It currently lists CISM or CISSP only.
- ISACA membership cost. It was not on the pages we read, so the total cost for members is incomplete.
- How employers weigh the two credentials. We did not find a source that compares hiring demand for AAISM and AIGP.
- Pass rates for either exam. Neither issuer’s page we read publishes them.
FAQS
What does AAISM stand for?
ISACA Advanced in AI Security Management. It is ISACA’s credential for security leaders working on AI.
What does AIGP stand for?
Artificial Intelligence Governance Professional, issued by IAPP.
Do I need CISM or CISSP for AAISM?
Yes. ISACA’s page states that candidates must hold an active CISM or CISSP.
Does AIGP have prerequisites?
Prep sources report none. Confirm on IAPP’s site.
How many questions are on each exam?
ISACA’s content outline page lists 90 questions for AAISM. Prep sources report 100 questions for AIGP, with 85 scored and 15 unscored.
What are the AAISM domains?
AI Governance and Program Management (31%), AI Risk Management (31%) and AI Technologies and Controls (38%), according to ISACA.
What are the AIGP domains?
Reported as Foundations of AI Governance, Laws Standards and Frameworks, Governing AI Development, and Governing AI Deployment and Use.
How much does each exam cost?
ISACA lists AAISM at US459formembersandUS599 for non-members, plus a US50applicationfee.PrepsourcesreportAIGPatUS649 for members and US$799 for non-members. Check current fees before you book.
Which one is harder?
Neither issuer publishes difficulty ratings or pass rates on the pages we read. AAISM leans technical, and AIGP leans toward law and governance, so difficulty depends on your background.
Can I take both?
Yes, if you meet AAISM’s prerequisite. They overlap in governance but differ in emphasis, so holding both gives you a security view and a governance view.
Which is better for a privacy professional?
AIGP is the open option, since AAISM requires a security credential. Whether AIGP is “better” depends on your goals.
Where is the official information?
ISACA’s AAISM page is at the ISACA AAISM site. IAPP’s AIGP page is on IAPP’s own site, and we recommend reading its body of knowledge and candidate handbook before booking.
