ISC2 CSSLP study plan

Define confidentiality, integrity, availability, authentication, authorization, non-repudiation, and accountability, and map two concrete software controls to each

Compare the four risk-handling options (mitigate, transfer, avoid, accept) and apply them to three software-centric risk scenarios

State each core secure design principle (least privilege, separation of duties, defense in depth, fail-safe defaults, economy of mechanism, open design, complete mediation, least common mechanism, psychological acceptability) and give a code or config example of each

Classify the major categories of sensitive data (PII, PHI, PCI, IP, secrets) and identify the compliance driver attached to each

Diagram a data-flow model for a simple web application and mark trust boundaries

Sequence the phases of the SDLC and place the security activities (risk assessment, threat modeling, secure coding, security testing, security review gates) into each phase

Differentiate waterfall, iterative, agile/Scrum, DevOps/CI-CD, and spiral models and state where security gates fit in each

Describe the role of a security champion, the software security group, and the business owner, and assign a decision right to each

Identify the artifacts that constitute a software security assurance program (policy, standards, training records, gate criteria, metrics) and state the owner of each

Draft three measurable software security metrics using an objective-target-trend format

Classify requirements into functional, non-functional security, compliance, and assurance categories, and rewrite three vague requirements so each is testable

Derive misuse/abuse cases from a user story and generate at least six negative requirements from them

Apply a structured elicitation technique (structured interview, controlled requirements expression, or misuse-case workshop) to a stated scenario

Rank requirements by risk using likelihood and impact and justify the ordering in one sentence per requirement

Trace a single security requirement from source, to design element, to test case

Perform an architectural risk analysis using a threat-modeling method (STRIDE or similar): enumerate threats, rank them, and assign a mitigation to each

Measure and reduce the attack surface of a given design by identifying entry points, trust boundaries, and privileged operations

Select and justify security patterns for authentication, authorization, input validation, session management, logging, and error handling

Compare security architectures at the layer, host, and data level and choose one appropriate to a stated threat profile

Explain how cryptography is applied in design (symmetric/asymmetric choice, key management, hashing, digital signatures, TLS/PKI) and identify three classic design-time crypto failures

Map each of the eight OWASP-style vulnerability families (injection, broken authentication, sensitive data exposure, access control, misconfiguration, XSS, insecure deserialization, insufficient logging) to the design control that prevents it

List the elements of a secure coding standard and convert three of them into enforceable lint or review checklist items

Demonstrate how input validation, output encoding, parameterized queries, and error handling prevent injection and XSS in language-neutral pseudocode

Describe how secrets, keys, and credentials are stored and handled securely in source code and build artifacts

Rank the code-review techniques (self-review, peer review, static analysis, pair programming) by defect-finding effectiveness for a given defect class

Match test types (unit, integration, system, regression, fuzz, penetration, SAST, DAST, IAST, SCA) to the defect classes each is best at finding

Design a test plan that verifies five stated security requirements, specifying input data, expected result, and pass criteria

Determine when to stop testing by applying risk-based exit criteria and defect-triage thresholds

Explain how fuzzing and abuse-case testing extend functional testing and describe the artifacts each produces

Interpret a static analysis and dynamic scan finding and decide whether it is a true positive, false positive, or accepted risk

Define the hardening and configuration baseline activities for a release and list the artifacts that must accompany a deployment

Describe secure deployment practices including separation of duties for release approval, signed artifacts, and rollback capability

Explain how to design and use logging, monitoring, alerting, and incident response for a deployed application, including what must never be logged

Differentiate backup, disaster recovery, and business continuity objectives using RTO and RPO for a stated application

Identify the maintenance activities that keep a system secure (patch management, vulnerability management, re-assessment triggers, decommissioning and data disposal)

Identify and rank supply chain risks across people, process, technology, and third-party components, including provenance and integrity of dependencies

Describe the controls for evaluating and monitoring a third-party supplier or open-source component (SBOM, license review, vulnerable-component scanning, contract security terms)

Explain how tampering, counterfeit components, and malicious inserts are detected through signing, hashing, and reproducible builds

Re-derive the top 20 facts across all eight domains from blank paper and identify the three weakest areas

Complete timed mixed-domain practice sets under exam conditions and remediate every missed item to a written explanation