ISC2 announced four new on-demand courses on October 19, 2026, covering artificial intelligence governance, data, and enterprise risk. Each course takes three hours, awards three CPE credits, is delivered in English, and remains accessible for 60 days after purchase. The announcement lists a regular price of $120, or $96 for ISC2 members and associates.
The most important distinction is that these are continuing-education courses with a Validation of Completion, not four new ISC2 certifications. They can support a CISSP, CGRC, ISSAP, ISSMP, or CCSP development plan, but they do not replace a certification exam or ISC2’s separate AI security certification, which is still under development.
The official ISC2 announcement (opens in a new tab) introduces all four releases and links to the detailed product pages.
The four courses at a glance
| Official course | Level | Primary focus | Time / CPE |
|---|---|---|---|
| AI Governance Architecture | Advanced | Governance architecture, frameworks, and vendor risk | 3 hours / 3 CPE |
| AI-Driven Data Discovery and Sensitive Asset Inventory | Intermediate | Inventory, classification, privacy, and sovereignty | 3 hours / 3 CPE |
| AI Policy Mapping and Optimization | Intermediate | Control mapping and LLM guardrails | 3 hours / 3 CPE |
| Enterprise AI Risk Aggregation and Decision Support | Intermediate | Risk signals, human overrides, and auditability | 3 hours / 3 CPE |
The format is intentionally compact. This is not a beginner curriculum covering every part of AI security. Each course focuses on a professional decision and uses text or video, activities, an assessment, or an applied scenario depending on the product. The official pages also describe a Validation of Completion and ongoing technical support.
1. AI Governance Architecture: build a defensible posture
AI Governance Architecture (opens in a new tab) is the only advanced course in the set. It asks participants to reconcile the NIST AI Risk Management Framework, ISO/IEC 42001, the EU AI Act, and right-to-explanation requirements.
The point is not to study four frameworks in isolation. Learners identify shared controls, gaps, and an implementation sequence. The course also adds a frequently missed dimension: vendor risk architecture across the AI procurement lifecycle, from selection through offboarding.
This module is aimed at security architects, GRC specialists, compliance managers, risk officers, and security leaders who already understand governance. ISC2 specifically describes practitioners with CISSP, CGRC, or equivalent experience. A beginner may understand the theme, but the scenario’s value comes from defending choices among competing obligations.
A useful pre-course exercise
Select a real AI project and build a three-column matrix: obligation, shared control, and expected evidence. Add the control owner and related vendor risk. You will then have a concrete case for testing the course method rather than treating governance as an abstract map.
2. AI-Driven Data Discovery: know what data AI is using
AI-Driven Data Discovery and Sensitive Asset Inventory (opens in a new tab) starts with an operational problem: traditional inventories do not always follow data moving through ML pipelines, cloud regions, and models.
Learners identify blind spots, evaluate the limits of automated discovery, and select classification controls. The program also covers data masking, differential privacy, sovereignty, and jurisdictional risks when processing crosses regions.
The course targets data security architects, security and privacy engineers, data governance leads, cloud security architects, and compliance officers. It is particularly useful when an organization has launched several assistants or models without one consolidated inventory of sources, copies, outputs, and retention periods.
A practical deliverable
Prepare a small lifecycle register: collection, storage, preparation, training or grounding, inference, logging, and destruction. For each stage, note sensitive data, ownership, region, and control. This is not an official ISC2 template; it is a practical way to turn learning outcomes into evidence of skill.
3. AI Policy Mapping: reduce duplicated controls
AI Policy Mapping and Optimization (opens in a new tab) addresses the crosswalk between NIST AI RMF and ISO/IEC 42001 requirements. It also considers failure modes in automated GRC tools: a compliance dashboard may look current even though the underlying infrastructure has changed.
The course introduces LLM guardrails such as input filtering, personally identifiable information masking, audit logging, and safe zones for experimentation. Learners must select a mechanism for a specific threat vector rather than apply one generic configuration everywhere.
This module is relevant to cyber compliance analysts, IT auditors, GRC specialists, and architects who translate external requirements into policies, control libraries, and internal workflows.
A key caution
A mapping is not proof of effectiveness. Two requirements may point to the same control, but the organization must still show that the control exists, covers the correct scope, and produces reviewable evidence. During the course, keep “requirement mapped” separate from “control tested.”
4. Enterprise AI Risk Aggregation: decide when signals disagree
Enterprise AI Risk Aggregation and Decision Support (opens in a new tab) uses a fictional SaaS company. Participants rescore a risk-register item, handle two models that disagree, review a flagged transaction, and examine a service account that accumulated privileges.
The scenario moves from an analyst view to a portfolio view. Individually acceptable risks can create concentration risk when they depend on shared infrastructure. Learners also document a human override and assess nonhuman identities through least privilege.
The course is designed for risk managers, security architects, GRC analysts, and program leads. It reinforces that a probabilistic score is not a decision. A defensible override preserves the observed signals, rationale, owner, timestamp, and expected evidence.
How to choose without buying all four by default
Start from your current problem, not from the most attractive title.
| Your need | Priority course |
|---|---|
| Unify several frameworks and govern suppliers | AI Governance Architecture |
| Discover and classify data exposed to AI | AI-Driven Data Discovery |
| Convert requirements into controls and LLM guardrails | AI Policy Mapping |
| Resolve scores, document overrides, and aggregate risk | Enterprise AI Risk Aggregation |
Architecture is advanced; the other three courses are intermediate. If you still need a cybersecurity foundation, the French OnLevelUp guide to the October 2026 ISC2 CC preparation update is a more logical entry point. These new courses assume that you can already reason about controls, risk, data, and accountability.
For professionals also working on Microsoft agentic solution architecture, the OnLevelUp guide to Microsoft’s 2026 AI certifications helps distinguish solution design credentials from the deeper security-governance work covered here.
CPE, access, and completion: what to verify
ISC2 awards three Group A CPE credits per course, or up to twelve for all four. Product pages say CPE earned from the experience is automatically reported for ISC2 credentials on the first day of each month, with processing taking up to ten business days. Eligibility for another credentialing body depends on that organization’s rules.
Access is stated as 60 days from purchase. Do not confuse content length, access window, and the time available in your own calendar. A realistic plan is two sessions: roughly two hours for content and activities, then one hour for the assessment, notes, and a personal deliverable.
Exact completion requirements differ slightly across the product pages. Some explicitly require passing the assessment in addition to completing the learning experience and its evaluation. Check the selected product page when purchasing, especially if the Validation of Completion or CPE reporting is your main objective.
Do these courses prepare you for ISC2’s future AI certification?
ISC2 is separately developing an AI security certification and has said it anticipates a pilot by the end of 2026. The four courses announced on October 19 are neither that pilot nor an official exam outline for that certification.
They can still build relevant capabilities: governance, data security, risk decisions, nonhuman identity oversight, and traceability. Describe them accurately as continuing education and a Validation of Completion. Do not claim an additional certification after completing a three-hour course.
A one-week action plan
- Select a real problem and the matching course.
- Capture the learning outcomes before starting.
- Prepare one artifact: a control matrix, data register, policy crosswalk, or decision log.
- Complete the content while mapping each concept to the artifact.
- Finish the required activities and assessment.
- Confirm the Validation of Completion and CPE reporting.
- Add an anonymized version of the artifact to your portfolio, not only the course title.
This approach turns a short course into practical evidence. The new ISC2 releases are valuable because they target four points where AI programs frequently fail: governance architecture, data visibility, policy consistency, and defensible decision-making.
