Certification guide
CSSLPISC2 CSSLP: the honest guide
Everything ISC2 publishes about CSSLP, in one place: what the exam asks, how the domains are weighted, and what it takes to be ready.
This guide page is built from the registry, not written yet.
Everything below comes from CSSLP’s published exam data, and every figure links to the vendor page it came from. The researched version, with study plans and the parts nobody publishes, is still being written. This page is not submitted to search engines until it is.
See everything published on CSSLPWhat the exam actually asks you to do
Multiple choice and ISC2's advanced item types. There is no lab and no simulation, so the practice that matters is reading a scenario and choosing well.
Item formats
- Multiple choice
Nothing here needs a lab. Reading carefully and eliminating options is the whole skill. ISC2, CSSLP exam outline ↗
Domain breakdown and official weightings
From the official ISC2 exam outlines. Secure Software Architecture and Design is the heaviest domain at 15 percent, followed by Secure Software Implementation at 14 percent.
- Secure Software Concepts12%
- Secure Software Lifecycle Management11%
- Secure Software Requirements13%
- Secure Software Architecture and Design15%
- Secure Software Implementation14%
- Secure Software Testing14%
- Secure Software Deployment, Operations, Maintenance11%
- Secure Software Supply Chain10%
Where to focus: The eight weights are unusually flat, from 10 to 15 percent, so a single neglected domain costs about as much as any other and broad coverage beats depth in one favorite area. The outline follows the software lifecycle in order and carries an effective date of September 15, 2023, so check that date against anything you study from; Secure Software Supply Chain is the smallest domain at 10 percent and the one older material is most likely to be thin on.
What comes after passing
CSSLP is valid for 3 years. ISC2 runs a three-year certification cycle. CSSLP holders must earn a required three-year total of 90 CPE credits (60 of them Group A), which ISC2 lists as 30 suggested annually, and pay the U.S. $135 annual maintenance fee on each anniversary of the certification date.
Costs across the full renewal cycle are on the CSSLP cost page.
Frequently asked questions
How much experience does the CSSLP require?
ISC2 requires a minimum of four years cumulative, full-time experience in one or more of the eight domains of the current CSSLP Exam Outline. ISC2 states that a post-secondary degree (bachelors or masters) in computer science, information technology or a related field may satisfy up to one year, and that part-time work and internships may also count.
Can I take the exam before I have four years of experience?
Yes. ISC2 states that if you do not have the required experience you may become an Associate of ISC2 by passing the CSSLP examination, and you then have five years to earn the four years of required experience.
How much does the CSSLP exam cost?
ISC2 lists standard registration for the CSSLP exam at U.S. $599 in the Americas, Asia Pacific, the Middle East and Africa, EUR 575.04 in EMEA, and GBP 485.19 in the United Kingdom. Pricing and taxes are based on the location of exam administration.
What does renewal involve?
ISC2 members are on a three-year certification cycle. For CSSLP the required three-year total is 90 CPE credits, of which 60 must be Group A, and ISC2 suggests 30 per year. Members holding CSSLP also pay an annual maintenance fee of U.S. $135.
Keep reading
- CSSLP exam overview
The format, the domain weights and the renewal terms, sourced line by line.
- CSSLP passing score
The exact cut score, what kind of number it is, and the retake terms.
- How hard is CSSLP?
An honest difficulty read from the format, the clock and the weights.