ISC2Certified Secure Software Lifecycle Professional
The Certified Secure Software Lifecycle Professional (CSSLP) certification validates your ability to integrate security practices—authentication, authorization, and auditing—into every phase of the software development lifecycle (SDLC). It is designed for software and security professionals who build, test, and deploy secure applications. Earning the CSSLP demonstrates advanced application security skills and a commitment to best practices established by ISC2, helping you advance your career and gain recognition from employers and peers.
1710 practice questions · Updated 2026-07-30
8Domains
58Objectives
447Concepts
1710Questions
CSSLP Curriculum
Every domain, objective, and concept the CSSLP exam measures.
- Confidentiality
- Integrity
- Availability
- Authentication
- Authorization
- Accountability
- Nonrepudiation
- GRC Standards
- Least Privilege
- Segregation of Duties
- Defense in Depth
- Resiliency
- Economy of Mechanism
- Complete Mediation
- Open Design
- Least Common Mechanism
- Psychological Acceptability
- Component Reuse
- Waterfall model security integration
- Agile security practices
- Security roles in development methodologies
- Security gates and checkpoints
- Adapting security controls to methodology
- Compliance and governance in methodologies
- Documentation and traceability
- Managing security debt
- Security standards landscape
- Framework selection criteria
- Implementing security frameworks
- Security awareness programs
- Continuous improvement of security practices
- Security milestones
- Security checkpoints
- Control gates
- Break/build criteria
- Integrating milestones into SDLC
- Defining checkpoint criteria
- Stakeholder roles in gate reviews
- Handling gate failures
- Documenting security roadmap
- Security documentation purpose
- Types of security documentation
- Security documentation lifecycle
- Documentation stakeholders
- Documentation content and structure
- Documentation standards and templates
- Documentation versioning and control
- Documentation review and approval
- Documentation distribution and accessibility
- Documentation maintenance and updates
- Define security metrics
- Criticality level
- Average remediation time
- Complexity
- Key Performance Indicators (KPIs)
- Objectives and key results (OKRs)
- End of Life (EOL) policies
- Credential removal
- Configuration removal
- License cancellation
- Archiving
- Service-level agreements (SLA)
- Data disposition
- Data retention
- Data destruction
- Dependencies
- Security reporting types
- Report content and audience
- Dashboard design principles
- Feedback loop implementation
- Reporting frequency and triggers
- Metrics and KPIs for security
- Tooling and automation
- Integration with lifecycle phases
- Regulations, standards, and guidelines overview
- Applying relevant standards and frameworks
- Legal considerations in software security
- Risk management fundamentals
- Risk assessment and analysis techniques
- Technical vs. business risk distinction
- Change Management Process
- Incident Response Plan
- Verification and Validation
- Assessment and Authorization (A&A) Process
- Functional Requirements Definition
- Non-Functional Requirements Definition
- Security Requirements Elicitation
- Security Requirements Analysis and Prioritization
- Security Requirements Documentation
- Regulatory Authority Identification
- Legal Compliance Requirements
- Industry-Specific Compliance Standards
- Company-Wide Compliance Policies
- Data ownership roles
- Data labeling by sensitivity and impact
- Structured vs unstructured data
- Data lifecycle stages
- Handling PII and public data
- Data collection scope
- Data anonymization techniques
- User rights and preferences
- Data retention requirements
- Cross-border data requirements
- User provisioning
- Service accounts
- Reapproval process
- Mitigating control identification
- Traceability Matrix Fundamentals
- Traceability Artifacts
- Traceability Link Types
- Creating Traceability Links
- Maintaining Traceability
- Using Traceability for Coverage Analysis
- Traceability in Risk Management
- Traceability Tools and Automation
- Traceability in Compliance and Audits
- Third-party vendor risk assessment
- Vendor security requirements definition
- Contractual security clauses
- Vendor security assessment and due diligence
- Ongoing vendor monitoring and management
- SABSA framework
- Security chain of responsibility
- Federated identity
- Security controls identification
- Security controls prioritization
- Client-server architecture
- Peer-to-peer (P2P) architecture
- Message queuing architecture
- N-tier architecture
- Service-oriented architecture (SOA)
- Enterprise service bus (ESB)
- Web services security
- Microservices security
- Client-side exploits and threats
- Remote code execution risks
- Constant connectivity implications
- IoT security fundamentals
- Wireless security
- Location-based services security
- RFID security
- NFC security
- Sensor networks security
- Mesh network security
- Secure boot
- Secure memory
- Secure update
- SaaS security
- PaaS security
- IaaS security
- Implicit data collection privacy
- Side-channel mitigation
- Speculative execution mitigation
- Secure element
- Firmware security
- Driver security
- AI security
- Virtual reality security
- Augmented reality security
- Facility-related IoT security
- Automotive IoT security
- Robotics security
- Medical device security
- Software-defined production processes
- Security management interfaces
- Out-of-band management
- Log interface security
- Upstream and downstream dependencies
- Secure data and key sharing
- Protocol design choices
- API security weaknesses
- State management in protocols
- Threat modeling for protocols
- Credential Management
- Flow Control Mechanisms
- Data Loss Prevention (DLP)
- Virtualization Technologies
- Trusted Computing Concepts
- Database Security Controls
- Programming Language Environments
- Operating System Controls and Services
- Secure Backup and Restoration
- Data Retention, Retrieval, and Destruction
- STRIDE threat modeling methodology
- PASTA threat modeling methodology
- Hybrid Threat Modeling Method
- CVSS for threat scoring
- Advanced persistent threat (APT) characteristics
- Insider threat patterns
- Common malware types and behaviors
- Third-party supplier risks
- Attack surface identification and reduction
- Threat analysis techniques
- Threat intelligence gathering and application
- Architectural Risk Assessment Fundamentals
- Threat Modeling for Architecture
- Risk Identification in Architecture
- Risk Analysis and Prioritization
- Risk Mitigation Strategies
- Design Review Process
- Conducting Design Reviews
- Integrating Risk Assessment and Design Reviews
- Identify non-functional security properties
- Define security constraints
- Model security properties in architecture
- Analyze trade-offs among security properties
- Validate security constraints
- Deployment Topology
- Operational Interfaces
- CI/CD Pipeline Security
- Secure Configuration Management
- Monitoring and Logging
- Incident Response Integration
- Declarative vs. Imperative Security
- Concurrency and Thread Safety
- Input Validation and Sanitization
- Error and Exception Handling
- Output Sanitization and Encoding
- Secure Logging and Auditing
- Session Management
- Trusted and Untrusted APIs and Libraries
- Resource Management
- Secure Configuration Management
- Tokenization
- Isolation Mechanisms
- Cryptography Implementation
- Access Control Models
- Processor Microarchitecture Security Extensions
- Secure code reuse
- Vulnerability databases and lists
- Static application security testing (SAST)
- Manual code review
- Inspection for malicious code
- Watchdogs
- File Integrity Monitoring
- Anti-Malware Controls
- Implementing Security Controls
- Risk Strategy Selection
- Risk Mitigation Implementation
- Risk Acceptance Criteria
- Risk Transfer Mechanisms
- Risk Avoidance Measures
- Residual Risk Handling
- Trust contracts in systems-of-systems
- Security testing for integrated systems
- Security analysis of systems-of-systems
- Secure reuse of third-party code
- Software composition analysis (SCA)
- Anti-tampering techniques
- Code signing
- Obfuscation
- Compiler switches
- Address compiler warnings
- Security testing standards
- Functional security testing
- Nonfunctional security testing
- Testing techniques
- Testing environment setup
- Security researcher outreach
- Attack Surface Validation
- Automated Vulnerability Testing (DAST/IAST)
- Penetration Testing
- Fuzzing (Generated and Mutated)
- Simulation of Production Environment
- Failure Testing (Fault Injection, Stress, Break)
- Cryptographic Validation
- Unit Testing and Code Coverage
- Regression Testing
- Integration Testing
- Continuous Testing
- Misuse and Abuse Case Testing
- Documentation Verification Purpose
- Installation and Setup Instructions Validation
- Error Message Validation
- User Guide Validation
- Release Notes Validation
- Documentation Consistency
- Security Relevance of Documentation
- Definition and examples of undocumented functionality
- Sources and origins of undocumented functionality
- Techniques for discovering undocumented functionality
- Risk assessment of undocumented functionality
- Mitigation and remediation strategies
- Impact on product management
- Prioritization of findings
- Break/build criteria
- Communication of results
- Defect vs. error vs. vulnerability
- Bug tracking process
- Security bug tracking tools
- Risk scoring fundamentals
- CVSS metrics and scoring
- Using risk scores in triage
- Test data generation
- Referential integrity in test data
- Statistical quality of test data
- Production-representative test data
- Production data reuse
- Data obfuscation
- Data sanitization
- Data anonymization
- Data tokenization
- Data aggregation mitigation
- Independent Verification and Validation (IV&V)
- Internal Verification and Validation
- Acceptance Testing
- Verification vs. Validation
- Test Planning for Verification and Validation
- Test Execution and Documentation
- Defect Tracking and Reporting
- Test Coverage and Traceability
- Entry and Exit Criteria
- Independent vs. Internal Testing
- Acceptance Test Planning
- Acceptance Test Execution
- Verification and Validation in SDLC
- Tools and Automation for V&V
- Metrics and Reporting for V&V
- Deployment environment types
- Environment-specific risk assessment
- Personnel training for administrators
- Personnel training for users
- Legal and regulatory compliance
- Compliance risk mitigation
- System integration risk analysis
- Integration testing and validation
- Hardware inventory and lifecycle
- Hardware security controls
- Baseline configuration definition
- Baseline configuration management
- Version control fundamentals
- Version control implementation
- Patch management process
- Patch deployment and verification
- Documentation of configuration and changes
- Documentation for compliance and audit
- Secure CI/CD pipeline design
- DevSecOps principles
- Application security toolchain components
- Toolchain integration and automation
- Build artifact integrity verification
- Code signing and provenance
- Hash verification and checksums
- Credential Management
- Secrets Management
- Key and Certificate Management
- Secure Configuration Management
- Secure boot fundamentals
- Secure boot implementation
- Least privilege principle
- Least privilege enforcement
- Configuration hardening
- Secure patch and update management
- Firewall and network security
- Secure provisioning of credentials
- Secure configuration provisioning
- Licensing and compliance
- Infrastructure as Code (IaC) security
- Security policy implementation
- Policy enforcement and monitoring
- Security Approval to Operate Definition
- Risk Acceptance Process
- Sign-off Authority Levels
- ATO Documentation
- Conditions and Limitations of ATO
- Continuous Monitoring and Re-authorization
- Observable data types
- Collecting and normalizing observable data
- Threat intelligence sources and types
- Integrating threat intelligence into monitoring
- Intrusion detection concepts
- Incident response process
- Regulation and privacy changes
- SIEM fundamentals
- Integration analysis with SIEM
- Incident triage
- Forensic evidence collection
- Forensic analysis
- Remediation planning
- Remediation verification
- Root cause analysis
- Post-incident review
- Patch management lifecycle
- Secure release process
- Patch testing strategies
- Patch deployment controls
- Patch compliance and auditing
- Vulnerability tracking
- Vulnerability triage
- CVE identification
- CVE utilization
- Vulnerability remediation
- Vulnerability reporting
- Vulnerability lifecycle management
- Runtime Application Self Protection (RASP)
- Web Application Firewall (WAF)
- Address Space Layout Randomization (ASLR)
- Dynamic Execution Prevention
- Runtime Protection Integration
- Runtime Protection Maintenance
- Backup strategies
- Archiving vs. backup
- Retention policies
- Disaster recovery plan (DRP) components
- DRP execution and testing
- Operational redundancy
- Erasure coding
- Survivability and DoS resilience
- Business continuity plan (BCP) scope
- BCP vs. DRP relationship
- BCP development and maintenance
- Define SLA and SLO
- Identify SLA components
- Maintenance objectives
- Performance objectives
- Availability objectives
- Qualified personnel requirements
- Integrate SLOs into operations
- Monitor and report SLA compliance
- Component Identification and Selection
- Component Risk Assessment
- Third-Party Component Inventory
- Continuous Monitoring for Changes and Vulnerabilities
- Third-party certifications
- Assessment reports and cloud controls matrix
- Origin and support of third-party software
- Chain of custody
- Authenticity and integrity in transfer
- Secure transfer protocols
- System sharing and interconnections
- Code repository security
- Build environment security
- Cryptographic hashing
- Digital signatures
- Right to audit
- Supplier Security Policy Compliance Auditing
- Vulnerability and Incident Notification Procedures
- Maintenance and Support Structure Evaluation
- Supplier Security Track Record Assessment
- Scope of Testing and Shared Responsibility
- Log Integration into SIEM
- Intellectual Property Ownership
- Code Escrow
- Liability and Indemnification
- Warranty Provisions
- End-User License Agreement (EULA)
- Service-Level Agreements (SLA)
Ready to practice?Test your knowledge with exam-style questions or take an intelligent quiz tailored to your level.
Percentages reflect share of the current practice bank, not official exam weightings — no structured per-skill weight is published for CSSLP, so none is invented.