🔥 Trending · DevSecOps Era

ISC2 Certified Secure Software
Lifecycle Professional (CSSLP)

Master the integration of security into every phase of the software development lifecycle with the ISC2 CSSLP — the premier credential for application security professionals and DevSecOps engineers.

Secure Software Development AppSec DevSecOps 4 Years Experience SDLC Security Software Supply Chain ISC2 Professional

Enroll Now

Secure RequirementsSecurity requirements elicitation

Secure ArchitectureThreat modeling & security design

Secure ImplementationOWASP & secure coding

Secure TestingSAST/DAST & security validation

175

Exam Questions

4 Hrs

Duration

4 Years

Experience Req.

Domains

Why It's Trending

Application Security Is the Fastest-Growing Cybersecurity Discipline

Organisations are embedding security engineers directly into development teams — and CSSLP holders are leading the charge.

Trending

Critical

AppSec Talent Shortage

Application security professionals are among the scarcest and most sought-after in cybersecurity.

$135K+

Average Salary

Certified application security engineers command top-tier compensation globally.

Trending

DevSecOps

Shift-Left Demand

Organizations are embedding security into CI/CD pipelines, driving CSSLP demand.

8 Domains

Full SDLC Coverage

CSSLP covers the complete software development lifecycle from requirements to disposal.

Certification

ISC2 CSSLP — Certified Secure Software Lifecycle Professional

CSSLP — Certified Secure Software Lifecycle Professional

The ISC2 CSSLP validates advanced technical skills in applying security practices throughout the software development lifecycle (SDLC). It is the global benchmark for software security engineers, DevSecOps professionals and AppSec leads responsible for building and maintaining secure applications.

Exam: CSSLP Certified Secure Software Lifecycle Professional. Prerequisites: Four years of cumulative paid work experience in one or more of the 8 CSSLP domains. Associate path: Take the exam without experience and become an Associate of ISC2.

Course Content

Complete CSSLP Curriculum — 8 Domains

Click any domain to expand and explore the topics covered in detail.

Secure Software Concepts

4 Topics

Core software security concepts: CIA triad, non-repudiation, defence in depth

Security policies, regulations and compliance requirements affecting software

Software development methodologies and their security implications

Privacy concepts and their application in software design

Secure Software Requirements

4 Topics

Security requirements elicitation techniques

Functional and non-functional security requirements

Data classification and protection requirements

Regulatory and compliance requirements mapping to software requirements

Secure Software Architecture and Design

5 Topics

Threat modeling methodologies (STRIDE, PASTA, VAST)

Secure architecture principles (least privilege, separation of duties, fail-safe defaults)

Security design patterns and anti-patterns

Cryptographic controls selection and key management

Security-enhancing technologies (API gateways, WAF, RASP)

Secure Software Implementation

5 Topics

Secure coding standards and common vulnerability prevention (OWASP Top 10)

Code analysis techniques: SAST, peer review, code walkthrough

Security libraries, frameworks and APIs

Input validation, output encoding and parameterized queries

Secure database interaction and injection prevention

Secure Software Testing

5 Topics

Security testing objectives and planning

Dynamic analysis techniques: DAST, fuzzing, penetration testing

Vulnerability assessment and management

Security regression testing in CI/CD pipelines

Test result analysis and remediation planning

Secure Software Lifecycle Management

4 Topics

SDLC model selection and security integration points

Security metrics, KPIs and risk measurement

Vendor and third-party software security management

Security training and awareness for development teams

Secure Software Deployment, Operations and Maintenance

4 Topics

Secure deployment planning and release management

Operational security: monitoring, logging and alerting

Patch management and vulnerability remediation

Incident response integration for deployed applications

Secure Software Supply Chain

4 Topics

Software composition analysis (SCA) and OSS risk management

Software Bill of Materials (SBOM) generation and management

Third-party component risk assessment and approval

Counterfeit and tampered component identification

FAQs

Frequently Asked Questions

What is the ISC2 CSSLP?

The CSSLP (Certified Secure Software Lifecycle Professional) validates expertise in integrating security across all phases of the software development lifecycle. It is the leading credential for application security engineers, DevSecOps practitioners and software architects.

What experience is needed?

Four years of cumulative paid work experience in one or more of the 8 CSSLP domains is required. Without the experience, you can take the exam and become an Associate of ISC2.

Who should get CSSLP?

CSSLP is ideal for software developers, software architects, application security engineers, DevSecOps engineers, security testers, software project managers and product security managers.

How is CSSLP different from GWEB (GIAC)?

Both target software security. CSSLP is a broader, vendor-neutral credential covering the full SDLC across 8 domains, while GIAC GWEB focuses more narrowly on web application security. CSSLP is more management-oriented alongside technical content.

What is the CSSLP exam like?

The CSSLP exam consists of 175 multiple choice questions to be completed in 4 hours. A score of 700 out of 1000 is required to pass. The exam is administered by Pearson VUE.

How does CSSLP align with DevSecOps?

CSSLP directly maps to DevSecOps practices — covering secure requirements, threat modeling, secure coding, SAST/DAST, supply chain security and CI/CD pipeline integration. It is the credential most aligned to the shift-left security movement.

ISC2 Certified Secure Software
Lifecycle Professional (CSSLP)

Application Security Is the Fastest-Growing Cybersecurity Discipline

ISC2 CSSLP — Certified Secure Software Lifecycle Professional

CSSLP — Certified Secure Software Lifecycle Professional

CSSLP Certified Secure Software Lifecycle Professional Exam

Complete CSSLP Curriculum — 8 Domains

Frequently Asked Questions

Build Security Into Every Line of Code

ISC2 Certified Secure SoftwareLifecycle Professional (CSSLP)

Application Security Is the Fastest-Growing Cybersecurity Discipline

ISC2 CSSLP — Certified Secure Software Lifecycle Professional

CSSLP — Certified Secure Software Lifecycle Professional

CSSLP Certified Secure Software Lifecycle Professional Exam

Complete CSSLP Curriculum — 8 Domains

Frequently Asked Questions

Build Security Into Every Line of Code

ISC2 Certified Secure Software
Lifecycle Professional (CSSLP)