ISC2 CSSLP Certification Guide: Domains and Requirements

Most security certifications treat software as one domain among many, so developers, architects and AppSec leads who own security across the whole software life cycle have few credentials that test that job end to end. ISC2's Certified Secure Software Lifecycle Professional (CSSLP) is built around it: eight domains running from requirements and design through testing, deployment, operations and the software supply chain. This guide sets out what ISC2 publishes about the CSSLP: the outline effective 15 September 2023, the four-year experience rule with its degree waiver and Associate route, endorsement, fees and continuing education. It adds a preparation plan and shows where the CSSLP sits next to hands-on AppSec and cloud credentials. It is for software engineers, application security engineers, architects and product security leads. Facts are as published by ISC2 and checked on 27 October 2026; confirm on the linked ISC2 pages before you book.

Key takeaways

It tests the life cycle, not coding tricks. ISC2 describes the CSSLP as recognising the ability to build security into each phase of the software development life cycle, including authentication, authorisation and auditing.
Eight domains, including supply chain. The current outline, effective 15 September 2023, ends with a Secure Software Supply Chain domain covering provenance, third-party software analysis and supplier requirements.
Four years of experience, one year waivable. ISC2 asks for four years of cumulative, full-time experience in one or more of the eight domains; a relevant degree can count for up to one year.
Associates get five years. Pass without the experience and you have five years to earn the four years required.
Renewal matches the CISSP-level credentials. 90 CPE credits per three-year cycle and a USD 135 annual maintenance fee, with the exam itself at USD 599 (EUR 575.04, GBP 485.19).

Who the certification is for

The CSSLP is ANAB accredited to ISO/IEC 17024 and approved by the US Department of Defense under DoDM 8140.03. Its experience rule places it at experienced practitioner level.

Strong fit: application security engineers and leads who run threat modelling, security requirements, testing strategy and release gates across many teams.
Good fit: senior developers, software architects and DevSecOps engineers moving into security ownership; product security managers who must show breadth across the life cycle.
Good fit for assurance roles: people who assess suppliers' development practices or approve software for operation, since domains 7 and 8 cover approval to operate and supplier requirements.
Weaker fit: penetration testers looking for a hands-on, practical exam; the CSSLP is knowledge based. See the OSEP and OSWE Certification Guide for a practical web application route.

Exam format and domains

Format

Item	What ISC2 publishes (checked 27 October 2026)
Current outline	Effective 15 September 2023; no replacement announced on the outline page
Number of domains	Eight
Items, duration, passing score, weights	Not stated on the HTML outline or certification page; confirm in the official outline document or when booking
Adaptive testing	ISC2's 2025 announcement moved CC, SSCP and CCSP to Computerized Adaptive Testing; it does not mention the CSSLP
Exam window and attempts	Exam Only: 365 days, one attempt. Peace of Mind Protection: 180 days, two attempts

We do not quote item counts or weights from third-party sites, which often lag outline changes.

The eight domains

Names and subtopics are from ISC2's outline effective 15 September 2023. The last column is our suggestion of practical reading, not part of the outline.

Domain	Name	Selected subtopics in the outline	See it in practice
1	Secure Software Concepts	Core concepts (confidentiality, integrity, availability, authentication, authorisation, accountability, non-repudiation, GRC); security design principles	Application Security Guide
2	Secure Software Lifecycle Management	Security in development methodologies; standards adoption; strategy and roadmap; documentation; metrics; decommissioning; reporting; integrated risk management; secure operation	Secure Software Development Lifecycle (SSDLC) Guide, AppSec Programme Metrics Guide
3	Secure Software Requirements	Security, compliance and privacy requirements; data classification; data access provisioning; misuse and abuse cases; requirement traceability matrix; third-party vendor requirements	Secure SDLC Policy Template
4	Secure Software Architecture and Design	Security architecture; secure interface design; reusable technology selection; threat modelling; architectural risk assessment and design reviews; non-functional security properties	Threat Modelling Guide
5	Secure Software Implementation	Secure coding; security risk code analysis; controls implementation; component evaluation and integration; security during the build	DevSecOps Guide
6	Secure Software Testing	Testing strategy and plan; security test cases; undocumented functionality; result analysis; error classification and tracking; secure test data	Open Source AppSec Tools Landscape Guide
7	Secure Software Deployment, Operations, Maintenance	Operational risk analysis; secure configuration and version control; secure release; security approval to operate; continuous monitoring; incident response; patch and vulnerability management; runtime protection; continuity; service levels	Vulnerability Management Guide
8	Secure Software Supply Chain	Supply chain risk management; third-party software security analysis; pedigree and provenance verification; supplier security and contractual requirements	SBOM Guide

ISC2's outline page also carries a paragraph on AI under each domain. They are not in the numbered subtopics, so use the official outline to judge whether they are examined, and expect questions on AI-assisted development to appear in future revisions.

Where identity fits: domain 1 names authentication, authorisation and accountability, domain 3 covers data access provisioning, and domain 5 covers security during the build. In practice that means service accounts and tokens used by pipelines, secrets in code and configuration, and workload identities for deployed services. See the CI/CD Security Guide and the Secrets Management Guide.

Prerequisites and experience

Rule	What ISC2 publishes
Experience	Minimum four years cumulative, full-time, in one or more of the eight domains
Nature of the work	Must involve secure software life cycle or application security knowledge
Degree waiver	A bachelor's or master's degree in computer science, IT or a related field can count for up to one year
Part-time	20 to 34 hours a week; 1,040 hours equal six months, 2,080 hours equal twelve; full-time is 35 hours a week
Internships	Paid or unpaid, documented on organisation letterhead or registrar's stationery
Associate route	Pass without the experience and become an Associate of ISC2, with five years to earn the four years

Choosing a route

Four years in development with security duties: document the security parts of the work (threat models, security reviews, test plans, release gates). General development alone may not qualify.
Three years plus a degree: the waiver brings you to the requirement.
Knowledge ready, experience short: take the Associate route and log qualifying work as you go.

Endorsement

Endorser: an ISC2 certified professional in good standing, or ISC2 with proof of employment.
Deadline: nine months from the exam date; submit only after the pass notice.
Audit: a random selection of applications is audited.

Preparation plan

The plan assumes ten to twelve weeks of part-time study. ISC2 sells official self-paced (90 or 180 days) and instructor-led training, with or without an exam voucher.

Confirm route and outline (week 0): check experience against the eight domains, find an endorser, and download the outline effective 15 September 2023, noting the format it states.
Baseline (week 1): a diagnostic across all eight domains. Developers are usually weakest on domains 2 and 8; security staff on domains 5 and 6.
Life cycle frameworks (weeks 2 to 3): read the NIST SSDF (SP 800-218) and OWASP SAMM to see how secure development practices are grouped. See the NIST Secure Software Development Framework (SSDF, SP 800-218) Guide and the OWASP SAMM Guide.
Requirements and design (weeks 4 to 5): practise misuse cases, traceability matrices and threat models on a real application.
Implementation and testing (weeks 6 to 7): SAST, DAST and SCA in a pipeline; test case design; secure test data.
Operations (week 8): release, approval to operate, patching, runtime protection and incident response for applications.
Supply chain (week 9): SBOMs, provenance, third-party component analysis and supplier contracts.
Rehearse (weeks 10 to 12): timed practice under the outline's conditions; review every wrong answer against its subtopic.

Measuring readiness

Domain spread: consistent practice scores across all eight domains.
Artefact fluency: you can produce a threat model, a security requirements set and a test plan for one application.
Management view: you can answer from the perspective of the person accountable for the life cycle, not the individual developer.

Small vs large organisations: in small teams one engineer may cover every domain informally, so formal artefacts (traceability matrices, approval to operate) need extra study. In large organisations candidates often specialise and need time on the domains outside their team.

Cost, renewal and continuing education

Item	Amount or rule (ISC2, checked 27 October 2026)
Exam fee	USD 599 (Americas, Asia Pacific, Middle East, Africa and other regions); EUR 575.04 (EMEA); GBP 485.19 (United Kingdom)
Reschedule or cancel	USD 50 to reschedule, USD 100 to cancel (GBP 35 or 70, EUR 40 or 80)
Annual maintenance fee	USD 135; no extra AMF if you already hold an ISC2 certification
CPE per three-year cycle	90 in total: 60 Group A and 30 Group A or B
Suggested annual CPE	30 a year (20 Group A, 10 Group A or B)
Grace periods	90 days for CPE after the cycle ends; 90 days from the AMF due date
Associate of ISC2	AMF USD 50 a year

Common failure patterns

Answering as a developer: many questions ask what the person accountable for the programme should do first, not how to fix the code.
Skipping supply chain: domain 8 is a full domain; provenance and supplier requirements are unfamiliar to most developers.
Underestimating operations: domain 7 lists thirteen subtopics, from approval to operate to service levels.
Counting general development as experience: ISC2 asks for work involving secure software life cycle or AppSec knowledge.
Missing secrets and pipeline identity: build systems and their credentials are a common real-world weakness; the build and supply chain domains assume you understand them.

Where it fits on the career path

Before it: developer experience plus a foundation such as ISC2 CC or CompTIA Security+.
Alongside it: a cloud credential if your applications are cloud native (see the CCSP Certification Guide), or a practical web testing credential for hands-on depth.
After it: CISSP for breadth and leadership roles. See the CISSP Certification Guide.
Roles: application security engineer, product security lead, security architect. See the Application Security Engineer Career Guide.

ISC2 does not publish pass rates or salary figures on the pages checked, and we do not quote third-party estimates. For a comparison, see the Cybersecurity Certifications Guide.

Practitioner checklist

Map four years of security-related software work to the eight domains, applying the one-year degree waiver if eligible.
Download the outline effective 15 September 2023 and record the format it states.
Read the NIST SSDF and OWASP SAMM as frameworks for the life cycle.
Produce a threat model, requirements set and test plan for one real application.
Study supply chain: SBOMs, provenance and supplier contract requirements.
Practise answering from the programme owner's viewpoint.
Confirm your endorser and submit within nine months of passing.
Plan about 30 CPE credits a year and the USD 135 AMF.

ISC2 CSSLP Certification Guide