Certified Secure Software Lifecycle Professional (CSSLP)
Credential: Certified Secure Software Lifecycle Professional (CSSLP)
Credentialing Agency: International Information Systems Security Certification Consortium, Inc. (ISC 2)
Renewal Period: 3 years
The Certified Secure Software Lifecycle Professional (CSSLP) certification is designed to validate an individual's competency in incorporating security into each phase of the software lifecycle to help mitigate threats. CSSLP holders have the knowledge and skills to break the penetrate and patch testing approach, reduce production costs, vulnerabilities and delivery delays, enhance the credibility of your organization and its development team, reduce loss of revenue and reputation due to a breach resulting from insecure software, and ensure compliance with government or industry regulations. CSSLP is for everyone involved in the Software Lifecycle with at least 4 years of experience.
More information can be found on the certifying agency's website.
Certified Secure Software Lifecycle Professional (CSSLP)
The following DOD Civilian Occupations provide training and/or experience that contributes to attaining this credential:
The following Federal Occupations provide training and/or experience that contribute to attaining this credential:
| Federal Occupation | Related As | |
|---|---|---|
| 0854 Computer Engineering |  Some |
|
| 2210 Information Technology Management Series |  Most |
MINIMUM REQUIREMENTS
Eligibility Requirements (View Details)
- Credential Prerequisite
- Experience: 4 years
- Education
- Training
- Membership
- Other
- Fee
Note: This credential may have multiple options for becoming eligible. Listed are the minimum requirements based on the minimum degree required. To view other options, see the Eligibility tab.
Exam Requirements (View Details)
- Exam
- Written Exam
- Oral Exam
- Practical Exam
- Performance Assessment
RECERTIFICATION SUMMARY
Renewal Period: 3 years
AGENCY CONTACT INFORMATION
International Information Systems Security Certification Consortium, Inc. (ISC 2)
311 Park Place Blvd
Suite 400
Clearwater, FL 33759
Phone: (866) 331-4722
Fax: (703) 356-7977
Email: membersupport@isc2.org
Education and/or Experience REQUIREMENTS
Candidates must have a minimum of four years of cumulative paid full-time professional experience in the software development lifecycle (SDLC) in one or more of the eight domains of the CSSLP.
Option 2:Candidates must have three years of cumulative paid full-time professional work experience in the SDLC in one or more of the eight CSSLP domains and a four year college degree or regional equivalent in Computer Science, Information Technology or related fields.
Other REQUIREMENTS
The Certified Secure Software Lifecycle Professional (CSSLP) credential has the following other requirements:
- Candidates must subscribe to the International Information Systems Security Certification Consortium, Inc. (ISC)2 Code of Ethics.
- Anyone who passes a CSSLP exam must have their qualifications endorsed by another (ISC2) credential holder.
- Passing candidates will be randomly selected and audited by (ISC2) Services prior to issuance of any certification. Multiple certifications may result in a candidate being audited more than once.
Written Exam
-
Secure Software Concepts (13%)
- Core Concepts
- Security Design Principles
-
Secure Software Requirements (14%)
- Identify Security Requirements
- Interpret Data Classification Requirements
- Identify Privacy Requirements
- Develop Misuse and Abuse Cases
- Include Security in Software Requirement Specifications
- Develop Security Requirement Traceability Matrix
-
Secure Software Design (16%)
- Perform Threat Modeling
- Define the Security Architecture
- Performing Secure Interface Design
- Performing Architectural Risk Assessment
- Modeling (Non-Functional) Security Properties and Constraints
- Model and Classify Data
- Evaluate and Select Reusable Secure Design
- Perform Design Security Review
- Design Secure Assembly Architecture for Component-Based Systems
- Use Security Enhancing Architecture and Design Tools
- Use Secure Design Principles and Patterns
-
Secure Software Implementation/Programming (16%)
- Follow Secure Coding Practices
- Analyze Code for Security Vulnerabilities
- Implement Security Controls
- Fix Security Vulnerabilities
- Look for Malicious Code
- Securely Reuse Third Party Code or Libraries
- Securely Integrate Components
- Apply Security during the Build Process
- Debug Security Errors
-
Secure Software Testing (14%)
- Develop Security Test Cases
- Develop Security Testing Strategy and Plan
- Identify Undocumented Functionality
- Interpret Security Implications of Test Results
- Classify and Track Security Errors
- Secure Test Data
- Develop or Obtain Security Test Data
- Perform Verification and Validation Testing (e.g., IV&V)
-
Secure Lifecycle Management (10%)
- Secure Configuration and Version Control
- Establish Security Milestones
- Choose a Secure Software Methodology
- Identify Security Standards and Frameworks
- Create Security Documentation
- Develop Security Metrics
- Decommission Software
- Report Security Status
- Support Governance, Risk, and Compliance (GRC)
-
Software Deployment, Operations, and Maintenance (9%)
- Perform Implementation Risk Analysis
- Release Software Securely
- Securely Store and Manage Security Data
- Ensure Secure Installation
- Perform Post-Deployment Security Testing
- Obtain Security Approval to Operate
- Perform Security Monitoring (e.g., managing error logs, audits, meeting SLAs, CIA metrics)
- Support Incident Response
- Support Patch and Vulnerability Management
- Support Continuity of Operations
-
Supply Chain and Software Acquisition (8%)
- Analyze Security of Third Party Software
- Verify Pedigree and Provenance
- Provide Security Support to the Acquisition Process
Exam Preparation Resources
There are a number of resources available to help you prepare for the Certified Secure Software Lifecycle Professional (CSSLP) examination:
- Best Sources
- General References
Testing Information
Testing for this credential is handled by Pearson VUE. The test centers are located in the U.S. They also have some test centers on military bases.
To find out more, use the following links on the Pearson VUE website:
For more information on the International Information Systems Security Certification Consortium, Inc. (ISC 2) testing process, visit the agency website.
RECERTIFICATION
Certified Secure Software Lifecycle Professional (CSSLP)
Renewal Period: 3 years
Additional considerations for the Certified Secure Software Lifecycle Professional (CSSLP) include:
- Candidates who do not have the required experience may still sit for the exam and become an Associate of (ISC)2 until they have gained the required experience. Once the required experience for the CSSLP certification is reached, the Associate of (ISC)2 can be converted to CSSLP status. Annual maintenance fees and continuing education requirements apply while working towards the experience requirement.
OTHER