OpenExamsFREE PRACTICE — ANY EXAM

Certified Secure Software Lifecycle Professional (CSSLP) — Requirements & Free Practice

US · License preparation

200 free questions · Answer explanations · No signup required

Choose what to practice

Start with an exam below. Your examination requirements depend on your application pathway. View licensing requirements

Loading selected examination banks…

Licenses, application pathways and examination requirements

Each license and applicant pathway has its own requirements and exemptions. Choosing practice questions does not determine your eligibility.

Certified Secure Software Lifecycle Professional (CSSLP)

ISC2 professional certification validating secure software development lifecycle knowledge and skills, including authentication, authorization and auditing from design through deployment.

Licensing authority: ISC2 · Application information

Initial by examination
Certified Secure Software Lifecycle Professional (CSSLP)
Application
After official passing notification, complete the certification application within nine months of the exam date. Supply experience evidence and endorsement by an ISC2 certified professional in good standing, or request ISC2 endorsement with proof of employment; selected applications are audited.
Ethics And Initial Fee
Commit to the ISC2 Code of Ethics; after approval pay the first Annual Maintenance Fee to start membership, with no additional AMF if already holding an ISC2 certification.
Exam Before Experience
A candidate without the required experience may pass CSSLP and become an Associate of ISC2, then has five years to earn the four years required experience; Associate status is not CSSLP certification.
Experience
Four years cumulative full-time experience in at least one of the eight current CSSLP domains. A qualifying bachelor's or master's degree in computer science, IT or a related field may satisfy up to one year. Relevant part-time work and paid or unpaid internships may count under ISC2's documented hour and evidence rules.
Scheduling
Register through ISC2, choose the exam purchase option, complete checkout, use Courses and Exams to schedule, match account information exactly to test-center identification, and finalize an appointment on Pearson's website. Standard exam-only purchase: sit within 365 days; Peace of Mind: both attempts within 180 days, subject to retake intervals. Accommodation requests go to ISC2 before scheduling.
Waiver Limit
The CSSLP-specific policy establishes the degree reduction. General application policy limits any education or approved-certification experience waiver to one year; this does not waive the CSSLP exam or create a prerequisite exam.

Certified Secure Software Lifecycle Professional (CSSLP)

Provider
Pearson VUE Testing Center
Format
Computer-based examination; multiple choice and advanced item types; English
Exam questions
Total questions: 125.
Time limit
3 hours
Passing score
700 out of 1000 points
Examination outline
  • Secure Software Concepts (12%)
    • Understand core concepts
    • Understand security design principles
  • Secure Software Lifecycle Management (11%)
    • Manage security within a software development methodology
    • Identify and adopt security standards
    • Outline strategy and roadmap
    • Define and develop security documentation
    • Define security metrics
    • Decommission applications
    • Create security reporting mechanisms
    • Incorporate integrated risk management methods
    • Implement secure operation practices
  • Secure Software Requirements (13%)
    • Define software security requirements
    • Identify compliance requirements
    • Identify data classification requirements
    • Identify privacy requirements
    • Define data access provisioning
    • Develop misuse and abuse cases
    • Develop security requirement traceability matrix
    • Define third-party vendor security requirements
  • Secure Software Architecture and Design (15%)
    • Define the security architecture
    • Perform secure interface design
    • Evaluate and select reusable technologies
    • Perform threat modeling
    • Perform architectural risk assessment and design reviews
    • Model (non-functional) security properties and constraints
    • Define secure operational architecture
  • Secure Software Implementation (14%)
    • Adhere to relevant secure coding practices
    • Analyze code for security risks
    • Implement security controls
    • Address the identified security risks
    • Evaluate and integrate components
    • Apply security during the build process
  • Secure Software Testing (14%)
    • Develop security testing strategy & plan
    • Develop security test cases
    • Verify and validate documentation
    • Identify undocumented functionality
    • Analyze security implications of test results
    • Classify and track security errors
    • Secure test data
    • Perform verification and validation testing
  • Secure Software Deployment, Operations, Maintenance (11%)
    • Perform operational risk analysis
    • Secure configuration and version control
    • Release software securely
    • Store and manage security data
    • Ensure secure installation
    • Obtain security approval to operate
    • Perform information security continuous monitoring
    • Execute the incident response plan
    • Perform patch management
    • Perform vulnerability management
    • Incorporate runtime protection
    • Support continuity of operations
    • Integrate service level objectives and service-level agreements
  • Secure Software Supply Chain (10%)
    • Implement software supply chain risk management
    • Analyze security of third-party software
    • Verify pedigree and provenance
    • Ensure and verify supplier security requirements in the acquisition process
    • Support contractual requirements
Examination sources