Certified Secure Software Lifecycle Professional (CSSLP) Exam Guide
Validates knowledge of building security into software, from requirements and design to testing, deployment and supply chain.
CSSLP tests whether you can build security into each stage of the software lifecycle: setting requirements, designing and threat modeling, coding and testing securely, deploying and maintaining software, and managing third-party components. Prepare across all eight domains, especially the ones outside your own role, and practise choosing the best lifecycle decision in a scenario.
1Understand the exam
Syllabus
1Secure software concepts12%
1.1Understand core concepts
1.2Understand security design principles
2Secure software lifecycle management11%
2.1Manage security within a software development methodology
Example scenario: A product team wants to add a customer analytics feature. Which security and privacy requirements would you write before design starts?
4Secure software architecture and design15%
4.1Define the security architecture
4.2Perform secure interface design
4.3Evaluate and select reusable technologies
4.4Perform threat modeling
4.5Perform architectural risk assessment and design reviews
4.6Model (non-functional) security properties and constraints
4.7Define secure operational architecture
Example scenario: A design adds a public API that calls an internal payments service. Which threats would your threat model capture, and which design controls would you require?
5Secure software implementation14%
5.1Adhere to relevant secure coding practices
5.2Analyze code for security risks
5.3Implement security controls
5.4Address the identified security risks
5.5Evaluate and integrate components
5.6Apply security during the build process
6Secure software testing14%
6.1Develop security testing strategy & plan
6.2Develop security test cases
6.3Verify and validate documentation
6.4Identify undocumented functionality
6.5Analyze security implications of test results
6.6Classify and track security errors
6.7Secure test data
6.8Perform verification and validation testing
Example scenario: A release is due tomorrow and a dynamic scan finds a medium-severity injection issue. What information do you need, and who decides whether it ships?
Choose the single best answer from the listed options; one is correct and the others are distractors.
CertUp example
A web application builds database queries by joining user input into SQL text. Which secure coding practice most directly prevents injection?
Parameterized queries
Longer passwords
Larger log files
Serving the site over HTTPS only
Show answer
Parameterized queries. They keep user input as data, so it cannot change the structure of the query.
Drag each item to its correct position or category; the item counts only when every placement is right.
CertUp example
Drag each stage into the order it normally follows in a secure software lifecycle.
Testing
Requirements
Deployment
Design
Implementation
Show answer
Requirements, design, implementation, testing, deployment. Security requirements come first so that each later stage can check against them.
Click the area of a diagram, table or screen that answers the question; there are no written options.
CertUp example
A CI/CD pipeline diagram shows source control, a build server, an artifact repository and production. Third-party libraries are pulled in at the build server. Click the stage where a software composition analysis scan should run to find vulnerable dependencies before release.
Show answer
The build server. Scanning there catches vulnerable components before the artifact is stored and promoted to production.
Eligibility and booking
Experience required for certification
4 years in the software lifecycle
Required
Cumulative, full-time paid work in one or more of the eight CSSLP domains. Part-time work and internships can count. Experience is checked through endorsement after you pass.
Standard route
4 years in one or more CSSLP domains
Bachelor’s or master’s in computer science, IT or a related field
3 years
You can sit the exam first. Without the experience you become an Associate of ISC2 and have five years to earn it. After passing, submit your endorsement within nine months.
Create an ISC2 account, buy the exam and schedule with Pearson VUE. After passing, submit your endorsement and pay the first annual fee.
Rate yourself on the eight domains first. Developers often need the most time on requirements, supply chain and lifecycle governance; security generalists on implementation and testing.
Most candidates spend 40–100 hours. Plan for the low end if you build or secure software daily or hold a CISSP or CCSP; plan for the high end if secure development is new to you.
1Understand the examRead the syllabus and format, check you’re eligible and pick a target date.4 h
3Learn the core conceptsWork through one main course or book, topic by topic.41 h
4Practice with mock examsTake timed practice tests and review every mistake.21 h
5Prepare for exam dayBook the exam and check the ID and delivery rules.4 h
3Learn the core concepts
Choose one main course for the current eight domains. Learn what major standards and frameworks are for rather than memorizing document numbers.
Think across the whole lifecycle. Many questions ask what should happen earlier or later than your own role. Place the scenario in the lifecycle before choosing an action.
4Practice with mock exams
Practise by domain, then mixed sets, and use more than one question source. Review why each wrong option is wrong.
Development experience matters more than any book.
A candidate who failed despite years of security experience was told real SDLC experience helps more than memorization. A developer with decades of experience passed after two weeks and finished in 67 minutes.
Best video courseISC2 Certified Secure Software Lifecycle Professional (CSSLP) (2023) Cert Prep
Best official courseCSSLP Online Self-Paced Training