Certified Secure Software Lifecycle Professional credential artwork

Certified Secure Software Lifecycle Professional (CSSLP)

Validates knowledge of building security into software, from requirements and design to testing, deployment and supply chain.

Summary

CSSLP is ISC2's credential for building security into software, for developers, architects and application security professionals. It covers requirements and design through coding, testing, deployment and the software supply chain, and shows you can manage security across the whole lifecycle.

Good fit if

  • You build, test or secure software across the development lifecycle
  • You lead application security or secure development programs
  • Your target AppSec or government software roles name CSSLP

Look elsewhere if

  • You have no software development background: Security+ or SSCP
  • You want to show hands-on offensive testing: OSCP
  • You want a broad senior security credential: CISSP

Salary & jobs

Prerequisites

Experience required for certification

4 years in the software lifecycle

Required

Cumulative, full-time paid work in one or more of the eight CSSLP domains. Part-time work and internships can count. Experience is checked through endorsement after you pass.

Standard route4 years in one or more CSSLP domains
Bachelor’s or master’s in computer science, IT or a related field3 years

You can sit the exam first. Without the experience you become an Associate of ISC2 and have five years to earn it. After passing, submit your endorsement within nine months.

Cost

USD · US exam pricing · new ISC2 member
$599
$135
The $135 annual fee recurs and covers all your ISC2 certifications, so a current ISC2 member pays no extra. Rescheduling costs $50 and cancelling $100. Each retake is charged at the full exam fee.

What holders say

Not a way into security without development experience

When a QA lead asked whether CSSLP would help them pivot into software security, the top reply recommended building software engineering experience first.

r/isc2Reddit: the CSSLP (February 2025)

Renewal

CSSLP renews every three years through continuing education and an annual fee.

Renewal cycle
3 years
Continuing education
90 CPE credits
Maintenance fee
$135 / year USD

At least 60 credits must be Group A, related to the CSSLP domains; the other 30 can be Group A or professional-development Group B. One annual fee covers every ISC2 certification you hold.

ISC2 member policies ↗

Alternatives

Certified Information Systems Security Professional credential artwork
CISSP$884 required · Advanced

Broad senior security credential across eight domains.

Certified Cloud Security Professional credential artwork
CCSP$734 required · Advanced

Cloud security, including cloud application security.

OffSec Certified Professional credential artwork
OSCP$1,749 required · Advanced

Hands-on penetration testing.

FAQ

What are the CSSLP requirements?

Four years of paid work in one or more of the eight domains. A relevant bachelor’s or master’s degree reduces this to three. You can take the exam first and become an Associate of ISC2, with five years to earn the experience.

How much does CSSLP cost?

The exam is $599 in the US. After endorsement, the first $135 annual fee completes certification.

Is CSSLP hard?

It depends on your background. Candidates with real development experience often find it easier than CISSP; security generalists without development work find it less familiar.

Is the CSSLP exam adaptive?

No. Everyone answers 125 questions in up to three hours.

Last updated October 2026