Training course
This is a free, self-paced reading course for CSSLP: Certified Secure Software Lifecycle Professional: ISC2’s credential for the developers, architects, application security engineers, and DevSecOps leads who build security into every phase of the development lifecycle rather than bolting it on at the end. The distinction matters for how you study. Where the CISSP asks how you would run a security program, the CSSLP asks how you would ship code that was never vulnerable in the first place: which requirement to write, which design pattern to choose, which test to run before release. The course is written to build that judgment in the order the lifecycle actually runs.
It is organized as one module per official exam domain, in the order ISC2 publishes them, and each module carries the domain’s published weight. CSSLP covers more domains than any other ISC2 exam (eight, tracking software from concept through supply chain) and they sit unusually close together, between 10% and 15%. That is the exam’s defining difficulty: there is no heavy domain you can lean on to carry a passing score, so there is no module here you can safely skim. The material follows the outline that took effect September 15, 2023, including the AI security content ISC2 has since embedded throughout it.
What the course covers
Secure Software Concepts
Module 1 · 12%The vocabulary everything else is built on (confidentiality, integrity, availability, authentication, authorization, accountability, and nonrepudiation) alongside the classic design principles: least privilege, segregation of duties, defense in depth, fail secure, economy of mechanism, complete mediation, open design, and psychological acceptability. The module works through what each principle looks like when a design decision either embodies or violates it, including how the principles bend when the component in question is a probabilistic AI model.
Secure Software Lifecycle Management
Module 2 · 11%Running security as a program across the SDLC: control gates and break/build criteria inside both Agile and waterfall, maturity frameworks such as SAMM and BSIMM, security metrics, secure decommissioning at end of life, and the translation of technical risk into business terms. It also covers MLSecOps, governing generative AI coding assistants and retraining loops so they do not quietly route around the gates you established.
Secure Software Requirements
Module 3 · 13%Getting security in writing before a line of code exists: functional and non-functional security requirements, compliance and privacy obligations, data classification and ownership, misuse and abuse cases, and the traceability matrix that ties each requirement to the test that proves it. The AI material here is about scoping requirements for third-party LLMs, acceptable hallucination thresholds and explicit boundaries on autonomous actions.
Secure Software Architecture and Design
Module 4 · 15%The heaviest module: threat modeling with STRIDE and PASTA, attack surface evaluation, architectural risk assessment, and secure design across microservices, cloud service models, IoT, embedded, mobile, and trusted computing with TPMs. Most of the work is trade-off reasoning, where the trust boundary goes, which reusable technology to select, and how to draw Zero Trust boundaries around inference engines and vector databases.
Secure Software Implementation
Module 5 · 14%Where code meets keyboard: input validation and output encoding, parameterized queries, session management, error handling, secure logging, cryptographic agility, and analyzing code for risk with SAST, manual review, and software composition analysis. Build-time protections, code signing and compiler hardening, close the module out, along with prompt injection defenses and the vetting of AI-generated code.
Secure Software Testing
Module 6 · 14%Proving the controls actually work: test strategy and standards, DAST and IAST, penetration testing, fuzzing, fault injection, cryptographic validation, regression and misuse-case testing, CVSS-based classification of findings, and the protection of test data derived from production. The newer material covers probabilistic testing for embedded ML models, bias, drift, and adversarial evasion.
Secure Software Deployment, Operations, Maintenance
Module 7 · 11%Shipping and running it safely: signed build artifacts, secrets and configuration management, environment hardening, continuous monitoring into a SIEM, incident response and root-cause analysis, patch and vulnerability management, and runtime protections such as RASP and WAF. Continuity planning belongs here too, as does watching production models for algorithmic drift and adversarial manipulation.
Secure Software Supply Chain
Module 8 · 10%The smallest module by weight and the one regulators care most about: SBOM creation and maintenance, third-party component risk assessment, pedigree and provenance verification, build environment security, supplier security requirements written into acquisition, and contractual protections including code escrow and right to audit. The AI-era extension is the AI-BOM, tracking model weights, training datasets, and ML libraries the way you already track packages.
How to use it
Read the modules in order and treat the even spread of weights as instruction rather than trivia: with eight domains between 10% and 15%, the candidates who fail are usually the ones who went deep on architecture and implementation because that is where their day job sits, and left requirements, testing, or supply chain thin. After each module, take the matching portion of the CSSLP practice exam rather than waiting until the end, reading a domain and immediately testing it exposes the gap between recognizing a term and applying it to a design decision, which is what CSSLP items actually ask you to do. If you want to see the question style before committing, the free CSSLP sample is fifteen questions with no signup.
Reading the course itself requires a free Certifym account. For exam logistics (the 125-item linear format, the three-hour window, the 700-out-of-1000 scaled pass mark, and the four-year experience requirement) see the CSSLP certification guide.
What CSSLP Is and the Secure Software Mindset
The Certified Secure Software Lifecycle Professional (CSSLP) is an ISC2 credential aimed at developers, architects, quality engineers, project managers, and security professionals who work at the point where security meets the software development lifecycle. Unlike CISSP, which is broad and management-oriented, CSSLP is narrow and product-oriented: it assumes you are close to code, close to designs, or close to the release pipeline, and it tests whether you can integrate security controls into every phase from concept through decommissioning.
The mindset the exam rewards is straightforward but consequential: security is a property of the software, not an add-on to it. A control that is layered on top of an insecure design is fragile. A vulnerability that ships in requirements is cheaper to fix in requirements than in production. The CSSLP body of knowledge is organized around this idea, which is why the domains march in lifecycle order: concepts, lifecycle management, requirements, architecture and design, implementation, testing, deployment and operations, and finally supply chain.
You will notice this bias throughout the exam. When a question offers you two defensible answers, the one that acts earlier in the lifecycle almost always wins. Fixing an injection flaw during code review is better than catching it in a pen test; catching it in threat modeling is better still; designing it out with a parameterized data layer beats all of them. The CSSLP practitioner is not the person who finds the most bugs, but the person who prevents the most bugs from being written.
The exam is 175 questions over four hours, drawn from eight weighted domains, and it uses the standard ISC2 scaled score of 700 out of 1000 to pass. Question style favors scenarios that force you to choose the best next action for a software team, not just the technically correct one. Read the stem carefully for role clues (developer, architect, security lead), phase clues (design, implementation, release), and constraint clues (regulated environment, cloud-native, legacy). Those cues usually point directly at the intended answer.
One warning for candidates who come from a purely development background: CSSLP is a security certification, not a coding certification. It cares less about syntax than about why a particular practice reduces risk. You will not be asked to write code. You will be asked whether input validation belongs on the client, the server, or both, and why. If your instinct is to reach for the answer that is technically most elegant, override it and reach for the one that is safest for the users of the software.
Frequently asked questions about the CSSLP training course
Is the CSSLP training course free?
Yes. The course costs nothing to read and opens once you are signed in to a free Certifym account, no payment and no card.
How is the course structured?
One module per official CSSLP exam domain, in ISC2’s published order, with each module weighted to the domain’s published percentage. Because the eight domains sit between 10% and 15%, the modules are closer in size than on most exams, that is a deliberate reflection of how the exam distributes its items.
Does this replace ISC2’s official training?
No. ISC2 publishes the authoritative CSSLP exam outline and sells official self-paced and instructor-led training. This course is an independent study companion, written against the publicly available outline to be read alongside practice questions. It is not an ISC2 product and carries no ISC2 endorsement.
Do I need software development experience before starting?
The course assumes you have worked somewhere in the software lifecycle (writing, designing, testing, or shipping code) and it does not teach programming. ISC2 requires four years of experience across the lifecycle to hold the credential, though candidates without it can pass the exam and hold Associate of ISC2 status while they earn it.
What should I do after finishing the course?
Move to the CSSLP practice exam and work until you clear roughly 70% in every domain individually, not just on the total. A total score carried by architecture and implementation hides exactly the weakness the real exam finds. Then book with Pearson VUE.
Is the course current with the latest CSSLP outline?
It is built against the exam outline that took effect September 15, 2023, including the AI security material ISC2 has since embedded inside the existing eight domains, prompt injection, model and training-data protection, MLSecOps, probabilistic model testing, and the AI-BOM. ISC2 can revise the outline at any time; download the current one from isc2.org before you schedule.
Trademark notice & independence. Certifym.net is operated by Certifym Exam Services, LLC and is not affiliated with, endorsed by, or sponsored by ISC2, Inc. ISC2®, CSSLP®, CISSP®, and CBK® are registered marks of ISC2, Inc. Certification names and marks are used solely to identify the certification for which these independent study materials are designed. The CSSLP exam outline and its domain structure are the property of ISC2, Inc.; candidates should download the official, current exam outline directly from isc2.org.
All course content, questions, answers, and explanations on Certifym are original content created for study purposes. They are not actual ISC2 training materials or examination questions and are not represented as such. Studying with these materials does not guarantee a passing result on any live certification exam. Exam requirements, format, domain weights, pricing, and endorsement policies are set by ISC2 and may change; always verify current details on isc2.org before scheduling your exam.