Skip to content
CertGPS

Certified Secure Software Lifecycle Professional

Tests security across the whole software lifecycle, from requirements and threat modeling to release, patching and supplier code

AdvancedISC2

The exam

Exam cost
$599
Study time
4-6 months
Passing score
700 out of 1000
Valid for
3 years

Before you book

  • Required: four years of cumulative full-time experience in one or more of the eight CSSLP domains
  • A relevant bachelor's or master's degree can substitute for one year
  • Without the experience: pass to become an Associate of ISC2, with five years to qualify

What it covers

Security domains

Career

US pay and outlook from the Bureau of Labor Statistics for the closest BLS occupation to each role this certification fits. BLS doesn't report pay by certification, and counts most of these roles only within a wider occupation, so the figures describe that occupation, not the role or the credential.

Where people with it work

  1. Entry level

  2. Mid level

  3. Senior level

Where it leads

  1. Certified Information Systems Security Professional

    Expert

    Comes before. Broadens CSSLP's software focus to all eight security domains, with a five-year experience bar

  2. Certified Secure Software Lifecycle Professional

    You are here

Study guide

Last updated

CSSLP Study Guide: The 2023 Outline, the Exam and a Hands-On Plan

The Certified Secure Software Lifecycle Professional (CSSLP) tests whether you can build security into each stage of making software: requirements, threat models, code, testing, release, patching and the suppliers whose components you ship. ISC2 asks for four years of experience. The outline in force took effect on September 15, 2023, and McGraw Hill's All-in-One prep book came out in January 2022, so part of your preparation is mapping an older text onto newer domains.

Who the CSSLP suits, and who should choose something else

It suits a software engineer or architect who has taken on security responsibilities, an application security specialist who works across many teams, or a test lead who owns security testing. ISC2's own list reaches further, to software procurement analysts, project managers and IT managers. Because the exam is written for all of them, it rewards people who know how secure software gets specified, bought, approved and maintained, and a strong coder with no process experience will find parts of it unfamiliar.

If you want to prove you can find and exploit flaws in web applications, a practical exam such as OSWE or GWAPT tests that directly. A Java developer who wants a coding-level credential can look at EC-Council's CASE Java. If your work covers the whole security program rather than software, CISSP is the broader choice.

CSSLP exam facts

Exam factDetail
FormatFixed length; multiple choice and advanced item types
Questions125
Time3 hours
Passing score700 out of 1000
Price (Americas)$599; $50 to reschedule, $100 to cancel
DeliveryPearson VUE test centers, English only
ExperienceFour years of cumulative full-time work in one or more of the eight domains; a relevant bachelor's or master's degree can count for one
Without the experiencePass and become an Associate of ISC2, with five years to qualify
RenewalThree-year cycle, 90 CPE credits, $135 annual maintenance fee

How the eight domains are weighted

Average weights from the outline effective September 15, 2023:

  • Secure Software Concepts: 12%
  • Secure Software Lifecycle Management: 11%
  • Secure Software Requirements: 13%
  • Secure Software Architecture and Design: 15%
  • Secure Software Implementation: 14%
  • Secure Software Testing: 14%
  • Secure Software Deployment, Operations, Maintenance: 11%
  • Secure Software Supply Chain: 10%

No domain is above 15% or below 10%, and that flat spread is the main thing to plan around. Architecture and Design is the largest, with threat modeling (STRIDE, PASTA, CVSS) at its center. Implementation and Testing follow at 14% each, covering static, dynamic and interactive testing, fuzzing, and runtime protections such as RASP and ASLR.

Two domains are about managing software security, and a third leans that way. Lifecycle Management asks for security metrics, KPIs and OKRs, roadmaps, reporting and decommissioning. Supply Chain covers software bills of materials, pedigree and provenance, supplier security requirements in procurement, and contract terms such as code escrow, warranties and EULAs. Requirements adds compliance, privacy, data classification, misuse and abuse cases, and a requirements traceability matrix. Together the three carry 34% of the weight, more than Architecture and Implementation combined.

The outline mentions artificial intelligence (AI) once, as an example under cognitive computing. ISC2's Exam Guidance for Artificial Intelligence, updated September 1, 2026, describes how AI topics map onto all eight domains of this same 2023 outline. Its examples include the OWASP Top 10 for LLMs, AI bills of materials and the NIST AI Risk Management Framework. Read it as a guide to how ISC2 now frames AI in software, but study from the outline.

A study plan with one real application

Start with the outline's 16 pages and its objectives 1.1 to 8.5. Wm. Arthur Conklin and Daniel Paul Shoemaker's CSSLP All-in-One Exam Guide, third edition, from McGraw Hill, comes with 350 practice questions online, but it uses the domain names and order from before the 2023 outline. Its "Secure Lifecycle Management" and "Supply Chain and Software Acquisition" chapters now feed Domains 2 and 8. Make a table that maps its chapters to the current objectives before you start reading, and note any objective the book doesn't cover. ISC2's online self-paced training follows the current domains, and its free flash cards cover the vocabulary.

Next, read NIST's Secure Software Development Framework (SSDF), SP 800-218 version 1.1. It's short and practice-based, and it fits Domains 2, 5 and 8 well.

For the hands-on part, run OWASP Juice Shop, a deliberately insecure web shop, on your own machine and treat it as a product you're responsible for:

  • Write three misuse cases and the security requirements that answer them.
  • Draw a data-flow diagram and threat model it with STRIDE.
  • Scan the source with a static analysis tool and the running app with a dynamic scanner, then classify and triage what each finds.
  • Produce a component list for its dependencies and decide which ones you'd question a supplier about.

That one project touches Domains 3, 4, 5, 6 and 8. We'd split your time roughly evenly between reading, the Juice Shop work and timed 125-question practice sets, and give the management domains more reading time than their weights suggest if you come from development.

Renewal, retakes and next certifications

Passing is followed by endorsement. An ISC2-certified professional in good standing signs off on your experience, or ISC2 acts as endorser if you don't know one. After that you pay the first annual maintenance fee (AMF) of $135, one fee for all your ISC2 certifications. Each three-year cycle needs 90 continuing professional education (CPE) credits, at least 60 of them Group A and tied to CSSLP domains, with a suggested 30 a year.

If you don't pass, the waits are 30 days before the second attempt, 60 before the third and 90 after that, with no more than four attempts in 12 months.

Where to go next:

  • CISSP for the full security program, once you have five years in at least two of its eight domains.
  • OSWE to prove you can find and exploit source-level flaws yourself.
  • GWAPT for web application penetration testing.

Our view

The CSSLP's strength is that it treats software security as a lifecycle that runs from requirements and procurement through approval to operate and supplier contracts. Few AppSec certifications test those topics, and they're what an application security lead spends meetings on. Its weakness is that the exam is all multiple choice and advanced item types, with no lab, so it doesn't show that you can find a bug or fix one. At $599 we think it's worth it for an AppSec lead, a security architect for development teams, or anyone whose employer wants a credential approved under DoDM 8140.03. A developer who wants to show hands-on skill should start with a practical exam.

Sources