thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

ISC2 · Cybersecurity · Professional

ISC2 CSSLP exam guide

Exam CSSLP

The CSSLP validates the ability to build security into every phase of the software development life cycle, from requirements and design through testing, deployment and supply chain management. It suits developers, AppSec engineers and architects in organizations that need demonstrable secure SDLC practices.

Questions125
Time limit180 minutes
Passing score700 out of 1000
Exam fee$599 USD
Valid for3 years
DeliveryPearson VUE test center

Format: Linear multiple choice. Fee note: Standard Americas price; varies by test location.

Who it's for

Software developers, application security engineers, architects and QA leads with at least four years of SDLC experience.

What the exam covers

Secure Software Concepts10%
Secure Software Lifecycle Management11%
Secure Software Requirements14%
Secure Software Architecture and Design14%
Secure Software Implementation14%
Secure Software Testing14%
Secure Software Deployment, Operations, Maintenance12%
Secure Software Supply Chain11%

Eligibility & prerequisites

Required: At least 4 years of cumulative paid SDLC experience in one or more of the 8 CSSLP domains, or 3 years plus a relevant 4-year degree. Candidates without experience can become an Associate of ISC2. Endorsement is required.

Recommended: Hands-on development or application security work across multiple SDLC phases.

Keeping it active

3-year cycle: earn 90 CPE credits and pay the ISC2 annual maintenance fee.

Skills & careers

Skills it validates

  • Defining security requirements and misuse cases
  • Threat modeling and secure design
  • Secure coding and code review
  • Security testing (SAST, DAST, fuzzing)
  • Secure deployment and operations
  • Software supply chain and SBOM management

Job roles

Application Security EngineerSoftware ArchitectSenior Software DeveloperDevSecOps EngineerProduct Security EngineerQA/Test Lead

DoD 8140

Recognized in the DoD 8140 qualification matrix for software development and secure software assessment work roles; check the current matrix. Open the DoD Workforce Navigator

Where it fits in your path

Planning a degree too? See how this cert earns college credit in the College Credit Navigator.

Build my study plan

  1. Week 1: Secure software concepts and life cycle management: CIA, security models, SDLC methodologies.
  2. Week 2: Requirements and architecture/design: threat modeling (STRIDE), secure design patterns.
  3. Week 3: Implementation and testing: OWASP Top 10, secure coding, SAST/DAST/IAST, fuzzing.
  4. Week 4: Deployment, operations and supply chain: configuration, patching, SBOM, vendor risk.
  5. Week 5: Practice exams and weak-domain review.

Make it yours: pick your exam date and weekly hours. We'll split your time by domain weight and give you a printable plan.

Exam-day tips

  • Four domains (requirements, design, implementation, testing) are 14% each; balance your study.
  • Know which SDLC phase each activity belongs to.
  • Supply chain is its own domain; know SBOMs, provenance and third-party code risk.
  • Answer from a program and process perspective, not just a coding view.
  • Know testing types and when each is used in the pipeline.

Key terms for this exam

All 248 terms Study with thinQcards™

Commonly confused on this exam

Frequently asked questions

How much does CSSLP cost?

$599 USD at the standard Americas price.

Do I need to be a developer?

You need 4 years of SDLC work experience, which can include testing, architecture or project roles, not only coding.

How do I maintain CSSLP?

Earn 90 CPE credits every 3 years and pay the annual maintenance fee.

CSSLP vs GWAPT?

CSSLP covers the whole secure SDLC program; GWAPT focuses on web app penetration testing.

Is CSSLP worth it?

It is valued in regulated industries and government where secure SDLC evidence is required.

Official page: www.isc2.org. Reviewed November 2026. Vendors change fees and objectives, so confirm with the vendor before you book. Spot something out of date? Tell us.