- Understand core concepts including confidentiality, integrity, availability, authentication, authorization, accountability, and nonrepudiation.
- Apply security design principles such as least privilege, segregation of duties, defense in depth, resiliency, and open design.
ISC2 Certification Training Course
ISC2 CSSLP® Certified Secure Software Lifecycle Professional Certification Training Course
Build the application security expertise that modern development teams need with Accumentum’s ISC2 CSSLP® Certified Secure Software Lifecycle Professional Certification Training Course, developed to help you build security into every phase of the software development lifecycle.
Course focus: Secure software concepts, lifecycle management, requirements, architecture and design, implementation, testing, deployment and operations, and the software supply chain.
Course Overview
Master the eight CSSLP domains.
The ISC2 CSSLP® Certified Secure Software Lifecycle Professional Certification Training Course with Accumentum gives you a complete look at the CSSLP credential. CSSLP validates that software professionals can incorporate security practices, including authentication, authorization, and auditing, into each phase of the software development lifecycle, from design and implementation to testing and deployment. This course covers all eight domains of the current CSSLP exam outline, including the dedicated Secure Software Supply Chain domain. You work through security design principles, threat modeling with STRIDE and PASTA, secure coding and code analysis, security testing strategies, secure CI/CD pipelines, and software bill of materials practices, along with the AI topics the updated outline adds. You leave ready to sit the CSSLP exam and to lead secure development work.
Course Benefits
Build CSSLP certification readiness and real-world capability.
01
Secure Software Foundations
Apply core security concepts and design principles such as least privilege, defense in depth, and complete mediation.
02
Requirements, Architecture, and Design
Define security, compliance, data, and privacy requirements, build secure architectures, and perform threat modeling.
03
Implementation and Testing
Apply secure coding practices, analyze code for risk, and plan and run security testing.
04
Deployment and Supply Chain
Release software securely through CI/CD, operate and monitor it, and manage third-party and supply chain risk.
Who Should Attend
- Software developers, engineers, and architects who build or design applications.
- Application security specialists and DevSecOps engineers.
- QA and test professionals who own security testing.
- Project and product leaders responsible for secure delivery of software.
Prerequisites
- ISC2 requires a minimum of four years cumulative, full-time experience in one or more of the eight domains of the current CSSLP exam outline. A qualifying degree may satisfy up to one year.
- Candidates without the required experience can become an Associate of ISC2 by passing the CSSLP exam and then have five years to earn the required experience.
- Familiarity with software development methods and at least one programming environment.
- Willingness to engage with design, code, and testing scenarios in preparation for the CSSLP exam.
Pathway Map
The CSSLP training course spans the eight official ISC2 exam domains.
The curriculum covers Secure Software Concepts (12%), Secure Software Lifecycle Management (11%), Secure Software Requirements (13%), Secure Software Architecture and Design (15%), Secure Software Implementation (14%), Secure Software Testing (14%), Secure Software Deployment, Operations, Maintenance (11%), and Secure Software Supply Chain (10%).
Course Content
- Set security milestones and checkpoints in the development strategy and roadmap.
- Incorporate integrated risk management methods using standards and models such as NIST, OWASP, SAMM, and BSIMM.
- Implement secure operation practices and decommission applications securely.
- Define functional and non-functional software security requirements.
- Identify compliance, data classification, and privacy requirements.
- Define data access provisioning and develop misuse and abuse cases.
- Define the security architecture across distributed, service-oriented, cloud, mobile, embedded, and IoT systems.
- Perform secure interface design and evaluate reusable technologies.
- Perform threat modeling with methods such as STRIDE and PASTA.
- Adhere to secure coding practices covering input validation, error handling, session management, cryptography, and access control.
- Analyze code for security risks with SAST, manual review, and vulnerability lists such as the OWASP Top 10 and CWE.
- Evaluate and integrate third-party components and apply security during the build process.
- Develop a security testing strategy and plan.
- Develop security test cases including DAST, IAST, penetration testing, fuzzing, and regression tests.
- Classify and track security errors, secure test data, and perform verification and validation testing.
- Perform operational risk analysis and manage secure configuration and version control.
- Release software securely through a secure CI/CD pipeline and manage secrets, keys, and certificates.
- Perform continuous monitoring, execute the incident response plan, and support continuity of operations.
- Implement software supply chain risk management, including maintaining a software bill of materials.
- Analyze the security of third-party software and verify pedigree and provenance.
- Ensure and verify supplier security requirements in the acquisition process.
Course Features
Designed for practical training and CSSLP exam preparation.
Interactive Learning
Participate in training sessions, discussions, and applied exercises with experienced instructors.
Comprehensive Study Materials
Access extensive resources, including e-books, video lectures, and practice exams.
Real-World Applications
Engage in practical exercises and case studies to apply CSSLP concepts.
Certification Preparation
Receive guidance and tips to successfully prepare for the ISC2 CSSLP® Certified Secure Software Lifecycle Professional Certification exam.
Certification Exam
Prepare for the official ISC2 CSSLP certification exam.
CSSLP Exam Readiness
Accumentum’s CSSLP Training Course prepares learners to apply the eight CSSLP domains in real work and on exam day.
Upon completing the ISC2 CSSLP® Certified Secure Software Lifecycle Professional Certification Training Course with Accumentum, you will be equipped to pursue the Certified Secure Software Lifecycle Professional (CSSLP) exam. The official exam is 3 hours, includes 125 items in multiple choice and advanced item types format, and requires a passing grade of 700 out of 1000 points. It is offered in English at Pearson VUE testing centers. CSSLP is listed in the DoD 8140 Foundational Qualification Matrix V2.1 (effective September 19, 2025), so it can support qualification for applicable DoD cyber workforce roles. Confirm your work role and proficiency level with your supervisor. CSSLP shows that you can build security into software from the start, which supports application security, DevSecOps, and secure development leadership roles across government and industry.
Exam Outline
What ISC2 says CSSLP covers.
This is the official ISC2 CSSLP exam outline: 8 domains and 58 objectives, in ISC2's own wording. Our course maps lessons and practice to each one.
Domain 1: Secure Software Concepts
Average weight 12%
- 1.1 Understand core concepts
- 1.2 Understand security design principles
Domain 2: Secure Software Lifecycle Management
Average weight 11%
- 2.1 Manage security within a software development methodology (for example Agile, waterfall)
- 2.2 Identify and adopt security standards (for example implementing security frameworks, promoting security awareness)
- 2.3 Outline strategy and roadmap
- 2.4 Define and develop security documentation
- 2.5 Define security metrics (for example criticality level, average remediation time, complexity, Key Performance Indicators (KPI), objectives and key results)
- 2.6 Decommission applications
- 2.7 Create security reporting mechanisms (for example reports, dashboards, feedback loops)
- 2.8 Incorporate integrated risk management methods
- 2.9 Implement secure operation practices
Domain 3: Secure Software Requirements
Average weight 13%
- 3.1 Define software security requirements
- 3.2 Identify compliance requirements
- 3.3 Identify data classification requirements
- 3.4 Identify privacy requirements
- 3.5 Define data access provisioning
- 3.6 Develop misuse and abuse
- 3.7 Develop security requirement traceability matrix
- 3.8 Define third-party vendor security requirements
Domain 4: Secure Software Architecture and Design
Average weight 15%
- 4.1 Define the security architecture
- 4.2 Perform secure interface design
- 4.3 Evaluate and select reusable technologies
- 4.4 Perform threat modeling
- 4.5 Perform architectural risk assessment and design reviews
- 4.6 Model (non-functional) security properties and constraints
- 4.7 Define secure operational architecture (for example deployment topology, operational interfaces, Continuous Integration and Continuous Delivery (CI/CD))
Domain 5: Secure Software Implementation
Average weight 14%
- 5.1 Adhere to relevant secure coding practices (for example standards, guidelines, regulations)
- 5.2 Analyze code for security risks
- 5.3 Implement security controls (for example watchdogs, file integrity monitoring, anti-malware)
- 5.4 Address the identified security risks (for example risk strategy)
- 5.5 Evaluate and integrate components
- 5.6 Apply security during the build process
Domain 6: Secure Software Testing
Average weight 14%
- 6.1 Develop security testing strategy & plan
- 6.2 Develop security test cases
- 6.3 Verify and validate documentation (for example installation and setup instructions, error messages, user guides, release notes)
- 6.4 Identify undocumented functionality
- 6.5 Analyze security implications of test results (for example impact on product management, prioritization, break/build criteria)
- 6.6 Classify and track security errors
- 6.7 Secure test data
- 6.8 Perform verification and validation testing (for example independent/internal verification and validation, acceptance test)
Domain 7: Secure Software Deployment, Operations, Maintenance
Average weight 11%
- 7.1 Perform operational risk analysis
- 7.2 Secure configuration and version control
- 7.3 Release software securely
- 7.4 Store and manage security data
- 7.5 Ensure secure installation
- 7.6 Obtain security approval to operate (for example risk acceptance, sign-off at appropriate level)
- 7.7 Perform information security continuous monitoring
- 7.8 Execute the incident response plan
- 7.9 Perform patch management (for example secure release, testing)
- 7.10 Perform vulnerability management (for example tracking, triaging, Common Vulnerabilities and Exposures (CVE))
- 7.11 Incorporate runtime protection (for example Runtime Application Self Protection (RASP), web application firewall (WAF), Address Space Layout Randomization (ASLR), dynamic execution prevention)
- 7.12 Support continuity of operations
- 7.13 Integrate service level objectives and service-level agreements (SLA) (for example maintenance, performance, availability, qualified personnel)
Domain 8: Secure Software Supply Chain
Average weight 10%
- 8.1 Implement software supply chain risk management (for example International Organization for Standardization (ISO), National Institute of Standards and Technology (NIST))
- 8.2 Analyze security of third-party software
- 8.3 Verify pedigree and provenance
- 8.4 Ensure and verify supplier security requirements in the acquisition process
- 8.5 Support contractual requirements (for example intellectual property ownership, code escrow, liability, warranty, End-User License Agreement (EULA), service-level agreements (SLA))
Exam Facts
How the CSSLP exam works.
Format
- Length of exam: 3 hours
- Number of items: 125
- Item format: Multiple choice and advanced item types
- Passing grade: 700 out of 1000 points
- Language availability: English
Domain weights
- Secure Software Concepts, 12%
- Secure Software Lifecycle Management, 11%
- Secure Software Requirements, 13%
- Secure Software Architecture and Design, 15%
- Secure Software Implementation, 14%
- Secure Software Testing, 14%
- Secure Software Deployment, Operations, Maintenance, 11%
- Secure Software Supply Chain, 10%
Requirements
Experience and upkeep for CSSLP.
ISC2 asks for at least four years of cumulative, full time experience in one or more of the eight CSSLP domains. A relevant bachelor's or master's degree can satisfy one year, and part time work and internships can count. If you pass without the experience, you become an Associate of ISC2 and have five years to earn it.
Once certified, ISC2 requires continuing professional education (CPE) credits and an Annual Maintenance Fee to keep the credential active.
Study Plan
A practical path to CSSLP.
We start with the domain map. CSSLP has 8 domains, and the heaviest is Secure Software Architecture and Design (15%). It gets the longest blocks and the most practice questions.
Each domain follows the same pattern. We teach the concepts, walk through a scenario, then work questions in the ISC2 style, where more than one answer looks right and you pick the best one for the situation.
Expect advanced item types as well as multiple choice. We practice those formats so the question style isn't new on test day.
The last stretch is review. You take a full length practice exam under the real time limit, then we go back over the domains where you dropped points.
Career Outlook
Where CSSLP can take you.
CSSLP fits people who build security into software. Common titles include application security engineer, software security architect, secure development lead and DevSecOps engineer.
The U.S. Bureau of Labor Statistics reports that the median annual wage for software developers, quality assurance analysts and testers was $134,040 in May 2025. A median is the midpoint, so half earned more and half earned less, and your own pay will depend on location, experience and employer. Source: BLS Occupational Outlook Handbook.
Funding and PathPay
Ways to pay for CSSLP training.
Accumentum is an Army CA and Air Force COOL Approved Vendor. If you're serving, start with your education center and read our Army CA and Air Force COOL pages for the steps.
Paying on your own? CSSLP prep is eligible for PathPay, our monthly payment plan. Terms of 3, 4 and 6 months carry no added fee. 9, 12 and 18 month terms add 5%, 10% and 15%. Course access opens when your first payment clears.
Our funding page has every other option, and you can talk with us or email info@accumentum.net before you enroll.
Frequently Asked Questions
Understand how Accumentum’s ISC2 CSSLP® Certified Secure Software Lifecycle Professional Certification Training Course supports certification preparation, eligibility, course content, delivery, and career advancement.
Certified Secure Software Lifecycle Professional (CSSLP) is an ISC2 certification. CSSLP validates that software professionals can incorporate security practices, including authentication, authorization, and auditing, into each phase of the software development lifecycle, from design and implementation to testing and deployment.
Software developers, engineers, and architects who build or design applications. Application security specialists and DevSecOps engineers. QA and test professionals who own security testing. Project and product leaders responsible for secure delivery of software.
ISC2 requires a minimum of four years cumulative, full-time experience in one or more of the eight domains of the current CSSLP exam outline. A qualifying degree may satisfy up to one year. Candidates without the required experience can become an Associate of ISC2 by passing the CSSLP exam and then have five years to earn the required experience.
The curriculum covers the eight official CSSLP domains: Secure Software Concepts, Secure Software Lifecycle Management, Secure Software Requirements, Secure Software Architecture and Design, Secure Software Implementation, Secure Software Testing, Secure Software Deployment, Operations, Maintenance, and Secure Software Supply Chain.
Yes. Accumentum’s CSSLP Training Course is designed to prepare you for the official ISC2 CSSLP certification exam and the competencies it assesses.
Yes. Participate in training sessions, discussions, and applied exercises with experienced instructors. Engage in practical exercises and case studies to apply CSSLP concepts.
Access extensive resources, including e-books, video lectures, and practice exams.
Eight domains, with weights of 12%, 11%, 13%, 15%, 14%, 14%, 11%, and 10% respectively, per the current ISC2 CSSLP Certification Exam Outline.
Accumentum is an Army CA and Air Force COOL Approved Vendor for ISC2. Talk with our team to confirm eligibility for your branch and credential before you enroll.
Enroll in the ISC2 CSSLP® Certified Secure Software Lifecycle Professional Certification Training Course with Accumentum via Accumentum’s registration page linked below, or explore PathPay Enrollment options.
CSSLP shows that you can build security into software from the start, which supports application security, DevSecOps, and secure development leadership roles across government and industry.
ISC2 lists the exam at 3 hours with 125 items.
ISC2 sets the passing grade at 700 out of 1000 points.
ISC2 publishes these average weights:
- Secure Software Concepts, 12%
- Secure Software Lifecycle Management, 11%
- Secure Software Requirements, 13%
- Secure Software Architecture and Design, 15%
- Secure Software Implementation, 14%
- Secure Software Testing, 14%
- Secure Software Deployment, Operations, Maintenance, 11%
- Secure Software Supply Chain, 10%
Secure Software Architecture and Design carries the most weight at 15%.
ISC2 asks for at least four years of cumulative, full time experience in one or more of the eight CSSLP domains. A relevant bachelor's or master's degree can satisfy one year, and part time work and internships can count. If you pass without the experience, you become an Associate of ISC2 and have five years to earn it.
Once certified, ISC2 requires continuing professional education (CPE) credits and an Annual Maintenance Fee to keep the credential active.
Accumentum is an Army CA and Air Force COOL Approved Vendor. Start with your education center, and we'll help with the rest.
Yes. CSSLP prep is eligible for PathPay. Terms of 3, 4 and 6 months add no fee. 9, 12 and 18 month terms add 5%, 10% and 15%.
Enrollment
Enroll in the ISC2 CSSLP® Certification Training Course with Accumentum.
Enroll in the ISC2 CSSLP® Certified Secure Software Lifecycle Professional Certification Training Course with Accumentum to advance your expertise and earn a globally recognized ISC2 credential. Accumentum is an Army CA and Air Force COOL Approved Vendor, and our team can walk you through funding options before you register.
Advance your cybersecurity career with CSSLP training.
Prepare for the ISC2 CSSLP certification exam and build the secure software concepts and secure software supply chain skills that employers look for.