ISC2 CSSLP

The ISC2 CSSLP page does not publish an item count or time limit, so treat any specific number you see elsewhere as unverified. Before booking, download the current CSSLP exam outline from ISC2, which defines the eight domains, and confirm appointment length and question format when you schedule through the testing provider.

Yes. ISC2 lists four years of required work experience alongside the exam, and the certification targets practitioners who already apply security practices somewhere in the SDLC. Candidates without that background should build relevant software development or application security experience first, then use the exam outline to map what they already do onto the eight tested domains.

An exam-only purchase gives you 365 days from purchase to schedule and sit the exam, so the exam code must be scheduled and administered within that window. Training bundles work differently: the exam portion still carries 365 days, while the course access period (90 or 180 days for self-paced, 180 days from first session for instructor-led) runs separately.

Peace of Mind Protection is an exam purchase that includes two attempts at a lower cost than buying two separate exams, and you have 180 days from purchase to sit both attempts, subject to the ISC2 Retake Policy. It shortens your overall window from 365 to 180 days, so choose it only if you can realistically test twice within that period.

Follow the lifecycle. Start with Secure Software Concepts and Lifecycle Management to fix the vocabulary and process model, then move through Requirements, Architecture and Design, Implementation, Testing, and Deployment/Operations/Maintenance. Finish with Supply Chain, which overlaps every earlier phase through third-party components, vendor risk, and procurement controls. This mirrors how the domains build on one another.

ISC2 lists software architects, engineers and developers, application security specialists, software program managers, QA testers, penetration testers, software procurement analysts, project managers, security managers, and IT directors or managers. The common thread is responsibility for applying security practices at some phase of the SDLC, not necessarily holding a security-specific job title.

The exam is about lifecycle process and governance, not only code-level controls. Candidates who study purely technical defense mechanisms tend to miss questions about requirements, risk trade-offs, supplier management, and who owns an activity in which phase. Reading each domain as a process - inputs, activities, outputs, roles - closes that gap faster than memorizing control lists.

ISC2 states the CSSLP is ANAB accredited to ISO/IEC Standard 17024 and approved under U.S. DoDM 8140.03, which matters for organizations and public-sector programs that map credentials to workforce requirements. Always confirm current acceptance with your specific employer or program, since qualifying lists and mappings are maintained by those bodies, not by the certifying organization alone.

ISC2 offers instructor-led and self-paced options plus self-study tools, and bundles pair training with an exam voucher. Bundles are convenient but add access windows you must track, such as 90 or 180 days of course access. Self-directed candidates should still anchor study on the official exam outline, then use practice questions to find weak domains rather than to memorize answers.

Retakes are governed by the ISC2 Retake Policy, which sets waiting periods between attempts; check the current policy text on ISC2 before you rebook. If you buy exam-only and then fail, you must purchase another attempt. Peace of Mind Protection avoids that second purchase by including two attempts, but both must be used within 180 days of purchase.