Training course

This is a free, self-paced reading course for CSSLP: Certified Secure Software Lifecycle Professional: ISC2’s credential for the developers, architects, application security engineers, and DevSecOps leads who build security into every phase of the development lifecycle rather than bolting it on at the end. The distinction matters for how you study. Where the CISSP asks how you would run a security program, the CSSLP asks how you would ship code that was never vulnerable in the first place: which requirement to write, which design pattern to choose, which test to run before release. The course is written to build that judgment in the order the lifecycle actually runs.

It is organized as one module per official exam domain, in the order ISC2 publishes them, and each module carries the domain’s published weight. CSSLP covers more domains than any other ISC2 exam (eight, tracking software from concept through supply chain) and they sit unusually close together, between 10% and 15%. That is the exam’s defining difficulty: there is no heavy domain you can lean on to carry a passing score, so there is no module here you can safely skim. The material follows the outline that took effect September 15, 2023, including the AI security content ISC2 has since embedded throughout it.

CSSLP Professional level 8 modules Domain-weighted Self-paced Free account

What the course covers

Secure Software Concepts

Module 1 · 12%

The vocabulary everything else is built on (confidentiality, integrity, availability, authentication, authorization, accountability, and nonrepudiation) alongside the classic design principles: least privilege, segregation of duties, defense in depth, fail secure, economy of mechanism, complete mediation, open design, and psychological acceptability. The module works through what each principle looks like when a design decision either embodies or violates it, including how the principles bend when the component in question is a probabilistic AI model.

Secure Software Lifecycle Management

Module 2 · 11%

Running security as a program across the SDLC: control gates and break/build criteria inside both Agile and waterfall, maturity frameworks such as SAMM and BSIMM, security metrics, secure decommissioning at end of life, and the translation of technical risk into business terms. It also covers MLSecOps, governing generative AI coding assistants and retraining loops so they do not quietly route around the gates you established.

Secure Software Requirements

Module 3 · 13%

Getting security in writing before a line of code exists: functional and non-functional security requirements, compliance and privacy obligations, data classification and ownership, misuse and abuse cases, and the traceability matrix that ties each requirement to the test that proves it. The AI material here is about scoping requirements for third-party LLMs, acceptable hallucination thresholds and explicit boundaries on autonomous actions.

Secure Software Architecture and Design

Module 4 · 15%

The heaviest module: threat modeling with STRIDE and PASTA, attack surface evaluation, architectural risk assessment, and secure design across microservices, cloud service models, IoT, embedded, mobile, and trusted computing with TPMs. Most of the work is trade-off reasoning, where the trust boundary goes, which reusable technology to select, and how to draw Zero Trust boundaries around inference engines and vector databases.

Secure Software Implementation

Module 5 · 14%

Where code meets keyboard: input validation and output encoding, parameterized queries, session management, error handling, secure logging, cryptographic agility, and analyzing code for risk with SAST, manual review, and software composition analysis. Build-time protections, code signing and compiler hardening, close the module out, along with prompt injection defenses and the vetting of AI-generated code.

Secure Software Testing

Module 6 · 14%

Proving the controls actually work: test strategy and standards, DAST and IAST, penetration testing, fuzzing, fault injection, cryptographic validation, regression and misuse-case testing, CVSS-based classification of findings, and the protection of test data derived from production. The newer material covers probabilistic testing for embedded ML models, bias, drift, and adversarial evasion.

Secure Software Deployment, Operations, Maintenance

Module 7 · 11%

Shipping and running it safely: signed build artifacts, secrets and configuration management, environment hardening, continuous monitoring into a SIEM, incident response and root-cause analysis, patch and vulnerability management, and runtime protections such as RASP and WAF. Continuity planning belongs here too, as does watching production models for algorithmic drift and adversarial manipulation.

Secure Software Supply Chain

Module 8 · 10%

The smallest module by weight and the one regulators care most about: SBOM creation and maintenance, third-party component risk assessment, pedigree and provenance verification, build environment security, supplier security requirements written into acquisition, and contractual protections including code escrow and right to audit. The AI-era extension is the AI-BOM, tracking model weights, training datasets, and ML libraries the way you already track packages.

How to use it

Read the modules in order and treat the even spread of weights as instruction rather than trivia: with eight domains between 10% and 15%, the candidates who fail are usually the ones who went deep on architecture and implementation because that is where their day job sits, and left requirements, testing, or supply chain thin. After each module, take the matching portion of the CSSLP practice exam rather than waiting until the end, reading a domain and immediately testing it exposes the gap between recognizing a term and applying it to a design decision, which is what CSSLP items actually ask you to do. If you want to see the question style before committing, the free CSSLP sample is fifteen questions with no signup.

Reading the course itself requires a free Certifym account. For exam logistics (the 125-item linear format, the three-hour window, the 700-out-of-1000 scaled pass mark, and the four-year experience requirement) see the CSSLP certification guide.

CSSLP Training: Building Secure Software

A structured, deeply written training course covering the eight CSSLP domains from concepts through supply chain. Written for developers, architects, security engineers, and technical leads preparing for the ISC2 CSSLP exam and for practitioners who want a durable reference on integrating security across the software lifecycle.

Module 1: Secure Software Concepts 10% of exam

The foundations: what secure software means, the principles that make it possible, how risk applies to code, and the compliance drivers that force organizations to care.

1.1 What CSSLP Is and the Secure Software Mindset 6 min Free preview
1.2 Core Security Principles: CIA, AAA, and Nonrepudiation 7 min 🔒
1.3 Security Design Principles 8 min 🔒
1.4 Risk Management for Software 7 min 🔒
1.5 Regulations, Privacy, and Compliance Drivers 8 min 🔒

Module 2: Secure Software Lifecycle Management 11% of exam

How to run a software program that produces secure output: SDLC choices, DevSecOps, roles and metrics, configuration management, and the policies that hold it together.

2.1 SDLC Models and Where Security Fits 7 min 🔒
2.2 Security in Agile and DevSecOps 8 min 🔒
2.3 Roles, Responsibilities, and Governance 6 min 🔒
2.4 Security Metrics and KPIs 6 min 🔒
2.5 Software Configuration Management 6 min 🔒
2.6 Threat Intelligence and Security Policy Management 6 min 🔒

Module 3: Secure Software Requirements 14% of exam

Requirements are the cheapest place to fix a security defect. This module covers how to identify, express, prioritize, and trace them so they survive into working software.

3.1 Identifying Security Requirements 7 min 🔒
3.2 Data Classification and Protection Requirements 7 min 🔒
3.3 Privacy Requirements 7 min 🔒
3.4 Compliance and Regulatory Requirements 6 min 🔒
3.5 Misuse and Abuse Cases 6 min 🔒
3.6 Security Requirements Traceability 6 min 🔒
3.7 Third-Party and Interface Requirements 6 min 🔒

Module 4: Secure Software Architecture and Design 14% of exam

Design is where security either becomes cheap or expensive. This module covers threat modeling, attack surface, secure patterns, and design decisions for modern platforms.

4.1 Threat Modeling: STRIDE, PASTA, LINDDUN 8 min 🔒
4.2 Attack Surface Analysis 6 min 🔒
4.3 Secure Design Patterns and Anti-Patterns 7 min 🔒
4.4 Architecture Reviews 6 min 🔒
4.5 Trust Boundaries and Interfaces 6 min 🔒
4.6 Cryptographic Architecture 8 min 🔒
4.7 Cloud, Mobile, and IoT Security Architecture 8 min 🔒

Module 5: Secure Software Implementation 14% of exam

Writing the code that actually resists attack: coding practices, common vulnerabilities, language-specific pitfalls, cryptographic use, and code review.

5.1 Secure Coding Practices 7 min 🔒
5.2 Common Vulnerabilities: Injection, XSS, CSRF, and Friends 9 min 🔒
5.3 Language-Specific Security 7 min 🔒
5.4 Implementing Cryptography Safely 7 min 🔒
5.5 Authentication and Session Management in Code 7 min 🔒
5.6 Input Validation and Output Encoding 6 min 🔒
5.7 Code Analysis: SAST, Code Review, and Peer Practice 7 min 🔒

Module 6: Secure Software Testing 14% of exam

Verifying that the software is as secure as intended: strategy, DAST and IAST, penetration testing, fuzzing, test environments, defect handling, and regression.

6.1 Security Test Strategy and Planning 7 min 🔒
6.2 Vulnerability Scanning and DAST 7 min 🔒
6.3 Penetration Testing 7 min 🔒
6.4 Fuzzing and Property-Based Testing 6 min 🔒
6.5 Test Data and Environment Security 6 min 🔒
6.6 Defect Tracking and Remediation 6 min 🔒
6.7 Regression, Verification, and Validation 6 min 🔒

Module 7: Secure Software Deployment, Operations, and Maintenance 12% of exam

Software that shipped clean must stay clean. This module covers release, hardening, monitoring, incident response, patching, and end-of-life.

7.1 Secure Deployment and Release Management 7 min 🔒
7.2 Configuration Hardening 6 min 🔒
7.3 Operational Security Monitoring 7 min 🔒
7.4 Incident Response for Software 7 min 🔒
7.5 Patch and Vulnerability Management 6 min 🔒
7.6 End-of-Life and Decommissioning 6 min 🔒

Module 8: Secure Software Supply Chain 11% of exam

Software is assembled from parts you did not write. This module covers the risks that come with the components, and how to keep them manageable.

8.1 Supply Chain Risks Overview 6 min 🔒
8.2 Third-Party and Open-Source Component Risk 7 min 🔒
8.3 Software Bill of Materials (SBOM) 6 min 🔒
8.4 Vendor Security Assessment 6 min 🔒
8.5 Secure Procurement and Contracts 6 min 🔒
8.6 Continuous Supply Chain Monitoring 6 min 🔒

Frequently asked questions about the CSSLP training course

Is the CSSLP training course free?

Yes. The course costs nothing to read and opens once you are signed in to a free Certifym account, no payment and no card.

How is the course structured?

One module per official CSSLP exam domain, in ISC2’s published order, with each module weighted to the domain’s published percentage. Because the eight domains sit between 10% and 15%, the modules are closer in size than on most exams, that is a deliberate reflection of how the exam distributes its items.

Does this replace ISC2’s official training?

No. ISC2 publishes the authoritative CSSLP exam outline and sells official self-paced and instructor-led training. This course is an independent study companion, written against the publicly available outline to be read alongside practice questions. It is not an ISC2 product and carries no ISC2 endorsement.

Do I need software development experience before starting?

The course assumes you have worked somewhere in the software lifecycle (writing, designing, testing, or shipping code) and it does not teach programming. ISC2 requires four years of experience across the lifecycle to hold the credential, though candidates without it can pass the exam and hold Associate of ISC2 status while they earn it.

What should I do after finishing the course?

Move to the CSSLP practice exam and work until you clear roughly 70% in every domain individually, not just on the total. A total score carried by architecture and implementation hides exactly the weakness the real exam finds. Then book with Pearson VUE.

Is the course current with the latest CSSLP outline?

It is built against the exam outline that took effect September 15, 2023, including the AI security material ISC2 has since embedded inside the existing eight domains, prompt injection, model and training-data protection, MLSecOps, probabilistic model testing, and the AI-BOM. ISC2 can revise the outline at any time; download the current one from isc2.org before you schedule.

Trademark notice & independence. Certifym.net is operated by Certifym Exam Services, LLC and is not affiliated with, endorsed by, or sponsored by ISC2, Inc. ISC2®, CSSLP®, CISSP®, and CBK® are registered marks of ISC2, Inc. Certification names and marks are used solely to identify the certification for which these independent study materials are designed. The CSSLP exam outline and its domain structure are the property of ISC2, Inc.; candidates should download the official, current exam outline directly from isc2.org.

All course content, questions, answers, and explanations on Certifym are original content created for study purposes. They are not actual ISC2 training materials or examination questions and are not represented as such. Studying with these materials does not guarantee a passing result on any live certification exam. Exam requirements, format, domain weights, pricing, and endorsement policies are set by ISC2 and may change; always verify current details on isc2.org before scheduling your exam.