Chapter 1 of 3 · ISACA AAISM
AI Governance and Program Management
AI stakeholders, frameworks and regulation, AI policy, asset and data life cycle, the AI security program and AI incidents.
- 6topics
- 33 minfast track
- 3diagrams and exhibits
- 31%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1AI Stakeholders and Industry FrameworksWho has a stake in AI and how the NIST AI RMF, its Generative AI Profile, ISO/IEC 42001, ISO/IEC 23894 and the OECD AI Principles…Diagram6 min
- 2AI Regulatory Requirements and the EU AI ActAI regulation for security managers: EU AI Act risk tiers, provider and deployer duties, phased application, penalties, GDPR…Diagram6 min
- 3AI Strategy, Charter, Policies and ProceduresAI governance charter, roles and RACI, an AI strategy aligned to business goals, AI security policy, standards, procedures and…5 min
- 4AI Asset Inventory and Data Life Cycle ManagementIdentifying, inventorying and classifying AI assets: models, datasets, prompts, vector stores, AI bills of materials, model cards…5 min
- 5AI Security Program Development and ManagementBuilding and running the AI security program: gap analysis, roadmap, resources, AI security metrics, choosing AI security tools…5 min
- 6AI Incident Response and Business ContinuityHandling AI security incidents: detection, evidence, containment, notification, escalation, eradication and recovery, plus AI in…Diagram6 min
About this chapter
What this chapter covers
AI Governance and Program Management is 31% of the ISACA AAISM exam. It is about advising stakeholders on securing AI through policy, data governance, program management and incident response, so that AI use supports business objectives and stays within the law and the organization's risk appetite.
The domain covers stakeholder considerations, industry frameworks and regulatory requirements (1A), AI strategies, policies and procedures (1B), AI asset and data life cycle management (1C), AI security program development and management (1D), and business continuity and incident response (1E).
The exam has 90 multiple choice questions, and candidates must already hold CISM or CISSP. Questions are written from the security manager's viewpoint: you choose what the manager should do FIRST, what is MOST important, or which option BEST aligns AI security with the business. General security management knowledge is assumed, so the questions turn on what is different about AI.
How the topics fit together
Governance starts with who has a stake in AI and which rules apply. Policy turns that into direction, the inventory shows what must be protected, the program delivers the controls and metrics, and incident response and continuity planning cover the day something goes wrong.
In AAISM governance questions, the security manager advises and coordinates. The business owns each AI use case and its risk, and senior management approves policy and appetite. An answer in which security alone decides whether the business may use AI is usually wrong.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with tables and examples.
- What to remember for the exam: the facts to memorise and how questions are phrased.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Ready for more practice?
The full ISACA AAISM question bank has 747 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.