CSSLP — Secure Software Lifecycle Professional
Of every certification this course profiles, this is the one built around this course's own subject matter rather than an adjacent one. CISSP treats secure development as one domain among eight covering the whole of information security; CKA and CKS each test a single platform. ISC2's Certified Secure Software Lifecycle Professional (CSSLP) is organized end-to-end around the secure SDLC itself — eight domains that start before a line of code exists and don't stop until a shipped product is retired. It pairs almost one-to-one with this course's own secure SDLC lesson and the gates that enforce it. What follows: what CSSLP actually tests, its own separate four-year experience bar, and who in this discipline should actually go sit it.
Most driving tests only check whether you can drive. Imagine one that also asked whether you picked a safe route before you left, packed the car correctly, checked the brakes at every stop, and inspected every part a mechanic bolted on that you didn't buy yourself. That's the difference between a certification that checks one skill and CSSLP, which checks whether you can keep a piece of software safe across its entire life — not just while you're typing.
What the CSSLP is, and why ISC2 built it as its own credential
☺ Like you're 10: It isn't "add a security chapter to a programming course" — it's a whole certification about the entire life of a piece of software, security built into every stage of it.
ISC2 — the organization behind CISSP — launched the Certified Secure Software Lifecycle Professional in 2008, aimed squarely at the people who actually touch the software development lifecycle: developers writing the code, architects making the design tradeoffs, QA engineers writing the test plans, and — increasingly, as the discipline has matured — the DevSecOps engineers wiring security checks into the pipeline that runs around all of them. It's a deliberately narrow credential compared to its sibling CISSP. CISSP's own domain 8, "Software Development Security," compresses secure coding, the SDLC, and supply-chain concerns into one domain among eight, covered in a handful of pages of the exam outline. CSSLP is that single domain, expanded into an entire eight-domain exam of its own — depth where CISSP only has room for breadth.
CISSP asks whether you understand security broadly enough to manage a program. CSSLP asks a narrower, harder question: given one specific piece of software, can you keep it secure from the first requirement to the day it's decommissioned — including every dependency someone else wrote that you decided to trust. That narrower question is exactly this course's own subject.
Format, cost, and prerequisites — verify before you book
☺ Like you're 10: The shape of the test — how long it is, what it costs, who's allowed to sit it — changes from time to time. Read the official page before you pay for anything.
The details below are what ISC2 generally publishes and what candidates consistently report at the time of writing. Every one of these has changed at some point in the exam's history, so treat this as planning information, not something to quote back at anyone.
| Item | What is generally published |
|---|---|
| Format | Computer-based, proctored (in person or online); multiple-choice and advanced innovative question types |
| Length | 125 questions in 4 hours — unlike ISC2's own CISSP, CSSLP is generally administered as a fixed linear form rather than computerized adaptive testing (CAT), though confirm this hasn't changed before you book |
| Passing score | A scaled score of 700 out of 1000 — the same scale ISC2 uses across its certification family |
| Price | Roughly USD $599 list; regional pricing and bundles are common |
| Validity | 3 years from the date you pass, maintained with continuing education |
| Experience requirement | 4 years of cumulative, paid work experience in one or more of the 8 CSSLP domains — or 3 years with a relevant four-year degree (or an ISC2-approved credential from its published list), which waives one year |
| No experience yet? | Pass the exam anyway and enroll as an Associate of ISC2, with a multi-year window (published by ISC2, historically several years) to accumulate the required experience and convert to full CSSLP |
| Endorsement | After passing, a currently certified ISC2 professional must endorse your application — generally within a matter of months of your exam date |
| Maintenance | Continuing Professional Education (CPE) credits over the 3-year cycle, plus ISC2's Annual Maintenance Fee (AMF) |
Price, exam length, question count, adaptive-vs-linear format, the experience waiver, and the domain weights below all change. Nothing on this page is authoritative — this site is independent and unofficial. Confirm current details on ISC2's own CSSLP certification page and read the current CSSLP Exam Outline PDF that ISC2 publishes before you register — it's the single source of truth for domain weights and the approved-degree list for the experience waiver.
The eight domains and their weights
☺ Like you're 10: Eight topics, unevenly sized — and two of them aren't really "a phase" at all, they're rules that apply to every phase at once.
These are the eight domains published in ISC2's CSSLP Exam Outline at the time of writing. They carry no sub-weights and sum to exactly 100%.
The first five read as a straight line through the SDLC. Secure Software Concepts (10%) covers the core vocabulary and models — CIA triad, privacy principles, secure design patterns — that every later domain assumes you already have. Secure Software Requirements (14%) is where security requirements get elicited, classified, and made testable alongside functional ones, the same ground this course's own threat modeling lesson works. Secure Software Architecture and Design (15%), the joint-largest domain, covers threat modeling formally, attack surface reduction, secure design principles like least privilege and defense in depth, and design for both security and privacy. Secure Software Implementation (15%) is secure coding practice — input validation, output encoding, safe error handling, avoiding the classic vulnerability classes — plus the code analysis (SAST) and code review that catch what a developer misses. Secure Software Testing (14%) covers test planning, static and dynamic analysis, fuzzing, and the difference between testing for function and testing for abuse.
The last three don't sit neatly at one point on a timeline, and that's deliberate. Secure Software Lifecycle Management (14%) is process and governance — secure SDLC methodology and maturity, change and configuration management, defining and enforcing compliance across the whole cycle rather than at one gate. Secure Software Deployment, Operations, Maintenance (12%) covers the operational tail: secure deployment, ongoing operations, incident response readiness, and end-of-life or disposal of software that's finally retired. Secure Software Supply Chain (6%), the smallest domain, is the newest emphasis in the outline — assessing third-party and open-source components, supplier risk, and the software bill of materials that documents what's actually in the thing you shipped.
How CSSLP's domains line up with this course
☺ Like you're 10: Almost every one of the eight domains already has a matching page here — this is the map from one to the other.
This is the closest a certification on this site gets to a table of contents for the course itself. If you're studying CSSLP alongside this material, work down this table in order rather than jumping around — the domains build on each other the same way the lessons do.
| CSSLP domain | Closest ground on this site |
|---|---|
| D1 · Concepts (10%) | What is DevSecOps? — the CALMS foundation everything else assumes |
| D2 · Requirements (14%) | Threat modeling — turning "what could go wrong" into testable requirements |
| D3 · Architecture & Design (15%) | The secure SDLC and secure SDLC gates & the DevSecOps Maturity Model |
| D4 · Implementation (15%) | Secure coding patterns and static analysis & secrets detection |
| D5 · Testing (14%) | SAST, DAST & SCA and dynamic analysis in practice |
| D6 · Lifecycle Management (14%) | Secure SDLC gates & DSOMM, maturity models: DSOMM, SAMM & BSIMM, compliance & governance |
| D7 · Deployment, Ops, Maintenance (12%) | Security in CI/CD and incident response & forensics |
| D8 · Supply Chain (6%) | Container & supply-chain security, software bills of materials, dependency & license risk |
Where CSSLP sits next to CISSP, CISM, and ISC2 CC
☺ Like you're 10: Same publisher, four very different jobs — one broad, one focused on running the security program, one for beginners, and this one focused entirely on the code itself.
All four share ISC2 as a publisher and its 700/1000 scoring scale, but they aim at different roles. CISSP is the broad, management-leaning credential covering all of information security — CSSLP's entire eight-domain scope is roughly what CISSP's single "Software Development Security" domain gestures at. CISM goes further still into governance and program management, barely touching code at all. ISC2 Certified in Cybersecurity (CC) is the entry-level credential with no experience requirement — a reasonable first stop if CSSLP's own experience bar feels out of reach today. CSSLP is the odd one out in the best way for this course: it's the only one of the four where "can you read a threat model, write a secure design, and review a dependency tree" is the entire exam, not a fraction of it.
| CSSLP | CISSP | ISC2 CC | |
|---|---|---|---|
| Core question | Can you keep one piece of software secure end-to-end? | Can you manage security across an organization? | Do you know the fundamentals? |
| Scope | The SDLC — requirements through retirement | All 8 CISSP domains — the whole of infosec | 5 introductory domains |
| Experience needed | 4 years (3 with a relevant degree) | 5 years (4 with a relevant degree) | None |
| Best fit here | Appsec engineers, secure architects, DevSecOps leads | Security managers, CISOs, broad practitioners | Newcomers building a foundation first |
Who in this discipline should actually sit it
☺ Like you're 10: If your job is making sure the software itself is built safely, this is your certificate. If your job is mostly about clusters, clouds, or catching attackers, there's probably a better-fitting one.
Sit the CSSLP if you own — or want to own — the secure SDLC itself: an application security engineer who reviews designs and writes secure coding standards, a software architect who needs security built into every design review rather than bolted on afterward, or a DevSecOps lead responsible for the gates in secure SDLC gates & the DevSecOps Maturity Model. It's also a strong pairing for anyone who came up through development and moved into security — CSSLP speaks the language of requirements, design reviews, and code, in a way exams built for infrastructure or cloud specialists don't.
Consider skipping it, at least for now, if your work is mostly infrastructure and cluster operations rather than application code — CKA and CKS are the better-targeted credentials there. Skip it too if your role is offensive security or penetration testing rather than building software securely; that's OSCP territory, a different skill entirely. And if the four-year experience bar (or the three-year, degree-waived version) is genuinely out of reach right now, either start with ISC2 CC to build a base, or use the Associate of ISC2 pathway to sit the exam today and bank the credential while you accumulate the required years.
Foxy: Eight domains for one certification? CISSP covers all of security in eight domains and this covers just the SDLC in the same number?
Professor Owl: That's exactly the point, Foxy. CISSP's domain 8 is a page or two on secure development. CSSLP takes that one page and makes it the whole exam.
Timmy the Turtle: I like that Lifecycle Management isn't tucked in at the end. It's 14% precisely because it's supposed to touch every gate I already run.
Benny the Beaver: And Implementation is 15% — the biggest slice tied with Architecture. Somebody at ISC2 agrees that writing the code carefully actually matters.
Pip the Hummingbird: Supply Chain is only 6%, though. Smallest domain on the exam.
Professor Owl: Smallest weight, not smallest risk, Pip. Six percent of a four-hour exam. A much larger share of what actually breaks in production.
Ellie the Elephant: So who should actually go sit this thing?
Professor Owl: Anyone who owns a secure SDLC gate, start to finish. Which — look around this room — is most of us.
1. How does CSSLP's scope compare to CISSP's own "Software Development Security" domain? 2. Name the eight CSSLP domains and their weights, and explain why two of them don't fit neatly into SDLC order. 3. What is CSSLP's experience requirement, and how can a relevant four-year degree change it? 4. Give two domains from the table and the course page that covers roughly the same ground. 5. Name one situation where a DevSecOps practitioner should consider a different ISC2 credential — or a non-ISC2 one — instead of CSSLP.
Check your answers
- CSSLP takes what CISSP compresses into a single domain among eight — secure development — and expands it into an entire eight-domain, standalone certification. CSSLP is depth on one topic; CISSP is breadth across all of information security.
- Secure Software Concepts 10%, Requirements 14%, Architecture and Design 15%, Implementation 15%, Testing 14%, Lifecycle Management 14%, Deployment/Operations/Maintenance 12%, Supply Chain 6%. Lifecycle Management and Supply Chain don't sit at one point on the timeline because they're governance and third-party-risk concerns that apply across every other phase — a compliance requirement or a vulnerable dependency can surface during requirements, design, implementation, or operations alike.
- A minimum of 4 years of cumulative, paid work experience in one or more of the 8 CSSLP domains — or 3 years if the candidate holds a relevant four-year degree (or an ISC2-approved equivalent credential), which waives one year of the requirement.
- Any two pairings from the table, e.g.: D3 Architecture and Design → the secure SDLC and secure SDLC gates & DSOMM pages; D5 Testing → SAST, DAST & SCA; D8 Supply Chain → container & supply-chain security and software bills of materials.
- Any reasonable answer, e.g.: an infrastructure- or cluster-focused engineer is better served by CKA/CKS; someone doing offensive security or penetration testing is better served by OSCP; someone without the experience yet (and no degree waiver) might start with ISC2 CC or use the Associate of ISC2 pathway instead of waiting to sit CSSLP.