CSSLP Exam Objectives (2026): Every Domain, Weight and What Gets Asked
The CSSLP blueprint has 8 domains and they are nowhere near equal. Here is the exact weighting, roughly how many questions each is worth, and the kind of question each domain actually produces.
The CSSLP blueprint at a glance
Every block below is sized to its share of the exam. The point of drawing it this way is simple: most candidates spread their study time evenly across domains, and the blueprint is not even. Secure Software Architecture & Design alone is 15% of your score.
Block size is proportional to domain weight. ISC2 publishes these as average weights, so individual exam forms vary slightly.
Domain by domain: what actually gets asked
Weights tell you how much a domain matters. They do not tell you what the questions feel like. This is the part most objective lists leave out.
Secure Software Architecture & Design
15%~19 questionsExpect threat-modelling scenarios: given an architecture, pick the design that removes a class of attack rather than patching one instance. Knowing STRIDE and trust boundaries pays off here.
Secure Software Implementation
14%~18 questionsCode-level judgement without being a language test. You choose the safe pattern — parameterised queries, output encoding, safe deserialisation — and identify what a review or SAST run should flag.
Secure Software Testing
14%~18 questionsWhich test finds which flaw. SAST vs DAST vs IAST vs fuzzing vs pen test, when each belongs in the pipeline, and how to turn findings into tracked, risk-ranked defects.
Secure Software Requirements
13%~16 questionsTurning vague business asks into testable security requirements: misuse and abuse cases, privacy and regulatory drivers, and traceability from requirement to control.
Secure Software Concepts
12%~15 questionsThe vocabulary layer — least privilege, defence in depth, fail secure, separation of duties — plus the regulatory and privacy landscape. Cheap marks if you drill the definitions.
Secure Software Lifecycle Management
11%~14 questionsGovernance questions: embedding security gates in the SDLC, security metrics that mean something, configuration and version control, and handling risk acceptance decisions.
Deployment, Operations & Maintenance
11%~14 questionsRelease and run-time concerns — secure deployment, secrets handling, patch and incident management, and continuous monitoring once code is live.
Secure Software Supply Chain
10%~13 questionsThe newest emphasis: supplier risk, provenance and integrity, open-source component governance, and what an SBOM is actually for.
The study order the weights imply
Sequencing by weight is not the only valid approach — but it is the one that protects your score if you run out of time.
Do first · 43% of the exam
- Secure Software Architecture & Design (15%)
- Secure Software Implementation (14%)
- Secure Software Testing (14%)
Then · 36%
- Secure Software Requirements (13%)
- Secure Software Concepts (12%)
- Secure Software Lifecycle Management (11%)
Last · 21%
- Deployment, Operations & Maintenance (11%)
- Secure Software Supply Chain (10%)
One caveat worth stating: a low-weight domain you know nothing about is still a guaranteed loss of those marks. Aim for competence everywhere and depth in the heavy domains, rather than ignoring the tail entirely.
Practise CSSLP the way it is actually asked
Exam-style questions weighted to the real blueprint, with an explanation on every answer.
Estimated question counts
Based on a 125-question form. Use it to set a target for how many practice questions per domain you should be getting right.
| Domain | Weight | Approx. questions | Miss all of it and you lose |
|---|---|---|---|
| Secure Software Architecture & Design | 15% | ~19 | 15 points |
| Secure Software Implementation | 14% | ~18 | 14 points |
| Secure Software Testing | 14% | ~18 | 14 points |
| Secure Software Requirements | 13% | ~16 | 13 points |
| Secure Software Concepts | 12% | ~15 | 12 points |
| Secure Software Lifecycle Management | 11% | ~14 | 11 points |
| Deployment, Operations & Maintenance | 11% | ~14 | 11 points |
| Secure Software Supply Chain | 10% | ~13 | 10 points |
FAQ
How many domains are on the CSSLP exam?
8. The heaviest is Secure Software Architecture & Design at 15% and the lightest is Secure Software Supply Chain at 10%. Weights are averages, so the exact split shifts a little between exam forms.
How many questions come from each CSSLP domain?
On a 125-question form, multiply the weight by the total: Secure Software Architecture & Design at 15% is roughly 19 questions. Treat these as planning estimates, not guarantees.
Which CSSLP domain should I study first?
Start with Secure Software Architecture & Design and Secure Software Implementation and Secure Software Testing. Together they are about 43% of the exam, so early progress there moves your score more than anything else.
Do the CSSLP objectives change?
Yes. ISC2 revises the blueprint periodically and weights move with it. Always download the current exam outline from ISC2 before you build a study plan, and check the version date against any course you buy.
ExamCert Team — we build exam-style practice banks for 90+ certifications. Domain weights here come from the current ISC2 exam outline; question-count figures are estimates derived from those weights.
Related: CSSLP exam guide · Is CSSLP worth it in 2026?