Am I Ready for CSSLP? Exam Readiness Checklist (2026)
Tick what you can do today, without notes. The board scores you against the ISC2 outline and says GO, HOLD or NO-GO before you spend US$599 on a booking.
- 125Questions
- 3 hoursTime
- 700/1000Pass mark
- US$599Fee
- Pearson VUEDelivery
Table of Contents
CSSLP is ISC2's credential for people who build security into software: application security engineers, software architects, senior developers and DevSecOps leads. The exam is 125 linear items over three hours, in English, at Pearson VUE test centres, and it spreads its weight almost evenly across eight domains, from 10% for supply chain to 15% for architecture and design.
That flat weighting is the whole story. Being a strong secure coder covers perhaps a seventh of the exam. Ready means you can also write testable security requirements, threat model a design, plan a security test strategy, sign off a release, run vulnerability management in production and hold a supplier to contract terms, and pick the most appropriate action when a scenario offers four plausible ones. If one SDLC phase is a blank for you, you are not ready yet.
How to use this checklist
Tick only what you can do today, without notes. Each tick is weighted by its domain's share of the official outline, so the score follows the exam, not the number of boxes. A heavy domain (15%+ of the weight) at NO-GO holds the verdict even when the total looks fine. Your ticks are saved in this browser only.
The CSSLP readiness checklist
25 items across 8 domains, each one a thing the exam expects you to do rather than recognise.
Your go / no-go board
One lamp per domain, one verdict overall. Amber and red rows are your study plan for the next week or two.
Check your ticks under exam conditions
A tick is a claim; a timed set of questions is the evidence. The CSSLP app has 1,100+ exam-style CSSLP questions with an explanation for every option. Do a mixed set and see whether the domains you ticked hold up.
App StoreGoogle PlayFree CSSLP practice testRed flags: don't book yet if...
Any one of these on the CSSLP is a better predictor of a fail than a low tick count.
You do not have four years in the SDLC and have not planned for that
Full certification needs four years of cumulative full-time experience in one or more CSSLP domains (a relevant degree can cover one year). Without it, a pass makes you an Associate of ISC2, with five years to earn the experience, a US$50 AMF and 15 CPE credits a year.
Fix:Decide before booking whether you are aiming for full CSSLP now or the Associate route, and keep records of part-time or internship work that may count.
You can code securely but cannot talk lifecycle, operations or supply chain
Lifecycle management (11%), deployment and operations (11%) and supply chain (10%) together make up nearly a third of the exam. Developers often lose most of their marks here, not in implementation.
Fix:Study how security gates, approval to operate, patch and vulnerability management, SBOMs and supplier contracts work in a real organisation, not just in code.
You pick tools instead of risk decisions
CSSLP scenarios usually ask what should happen first or what is most appropriate for the lifecycle phase. Answers that jump straight to a scanner or a framework miss the requirement, risk or ownership question underneath.
Fix:For each practice miss, name the SDLC phase and the decision-maker before you look at the options again.
Your notes do not match the current eight-domain outline
The outline in force has been effective since 15 September 2023 and names eight domains, ending with Secure Software Supply Chain. Material built on an older outline orders and labels topics differently, so weak spots hide.
Fix:Check your study plan against the domain names and sub-objectives on the current isc2.org outline page before you book.
You have never done a full 125-item, three-hour sitting
CSSLP is a long linear exam with no domain worth more than 15%, so you need steady accuracy across all 125 items. Breaks come out of the three hours.
Fix:Sit at least two full timed mocks and check whether your accuracy drops in the final third.
The numbers that say you're ready
Rules of thumb, not official thresholds: ISC2 does not publish a readiness score. Hit all four before you pay for a booking.
Rule of thumb, not an ISC2 number. The 700 pass mark is a scaled score, not a percentage, so leave a margin and measure on questions you have not seen before.
Three hours is about 86 seconds an item. A buffer is a rule of thumb that protects you if you take a break, since breaks run on the exam clock.
Rule of thumb. With every domain at 10-15%, one weak area costs as much as a strong one earns, and failing candidates get proficiency levels by domain.
A self-test, not an official measure. If you can explain requirements, threat model, code checks, tests, release approval and supplier controls for one feature, you have the breadth the exam assumes.
Booking and ID checklist
The logistics that trip people up are specific to the CSSLP and its delivery provider. Work through them in order.
Decide: full CSSLP or Associate
Four years of full-time experience in one or more CSSLP domains, with a relevant bachelor's or master's degree covering one year. Without it, passing makes you an Associate of ISC2 instead.
Set up your ISC2 account
Create or log in to your ISC2 account. The name on the Exam Account Information form must match your ID exactly or you cannot test and the fee is not refunded.
Buy the exam on isc2.org
US$599 in the Americas and APAC, EUR 575.04 in EMEA, GBP 485.19 in the UK, plus local tax. Exam-only purchases must be scheduled and sat within 365 days; Peace of Mind Protection gives two attempts within 180 days.
Request accommodations first
Send the ISC2 accommodation form and documentation to [email protected] before booking with Pearson, then allow two to three business days for Pearson to receive the approval.
Schedule a Pearson VUE test centre
From Courses and Exams in your ISC2 account, click Schedule and finish on the Pearson site. CSSLP is English only and test-centre only.
Fix any name mismatch
Names can be updated up to 48 hours before the appointment, never at the centre. An ID mismatch is treated as a no-show and the fee is lost.
Reschedule or cancel if needed
Pearson charges US$50 to reschedule and US$100 to cancel, and no rescheduling is possible inside 24 hours of the appointment.
Bring two IDs and arrive 30 minutes early
A primary ID with photo and signature plus a secondary ID with signature, both original and unexpired. Expect a palm vein scan; arriving within 15 minutes of start counts as late.
Exam-week countdown: T-7 to T-0
Take your final full timed mock, then spend the week on the two weakest domains. If supply chain or operations is one of them, rehearse SBOM, patching and approval-to-operate scenarios.
Confirm the appointment in both the Pearson and ISC2 dashboards and that both IDs carry the registered name. Drill short sets on threat modeling and testing techniques.
Stop new study. Pack both IDs, plan to arrive 30 minutes early and bring as little as possible, since storage at Pearson centres is small.
Store every device before the pat-down. Pace at about 86 seconds an item, read each scenario for the SDLC phase it describes, and remember any break eats exam time.
Test-day rules
✓ Allowed / expected
- Two original, unexpired IDs: a primary with photo and signature and a secondary with signature
- The erasable note board the test centre issues after check-in
- Earplugs, available on request
- Unscheduled breaks, with a palm vein scan before and after (the exam clock keeps running)
✕ Not allowed
- Phones, smartwatches or any electronic device; they must be stored before the pat-down
- Hats, scarves, coats or masks in the testing room
- Personal belongings at your workstation
- Leaving the building during a break unless absolutely necessary
- Covert recording devices; since June 2026 Pearson may screen with infrared and metal-detection wands
After you pass
Your result
You get an unofficial result from the proctor when you check out, and ISC2 emails the official one. No numeric score is given. ISC2 warns results can be delayed six to eight weeks when too few candidates have tested, which can affect lower-volume exams like CSSLP. A fail comes with a proficiency level for each domain.
Endorsement or Associate
Complete the certification application within nine months of your exam date, endorsed by an ISC2-certified member in good standing or by ISC2 with proof of employment. Review usually takes four to six weeks and some applications are audited. Without four years of experience you can become an Associate of ISC2 and have five years to earn it.
Keeping it current
CSSLP runs on a three-year cycle: 90 CPE credits per cycle (at least 60 Group A, the rest Group A or B) and a single US$135 Annual Maintenance Fee each year. After approval you can claim your Credly badge and digital certificate. Associates pay US$50 a year and earn 15 Group A credits annually.
The CSSLP at a glance
| Item | Detail |
|---|---|
| Questions | 125 items, multiple choice and advanced item types (linear, fixed form) |
| Time | 3 hours |
| Passing score | 700 out of 1000 scaled points |
| Fee | US$599 (Americas, APAC, Middle East, Africa); EUR 575.04 in EMEA; GBP 485.19 in the UK |
| Delivery | Pearson VUE test centres only, English only; ISC2 offers no online proctoring |
| Retakes | 30 test-free days after attempt 1, 60 after attempt 2, 90 after attempt 3 and beyond; max 4 attempts in 12 months |
| Results | Unofficial result from the proctor at check-out; official result by email, which ISC2 says can take 6-8 weeks on low-volume exams |
| Validity and renewal | 3-year cycle; US$135 AMF; 90 CPE credits per cycle (60 Group A plus 30 Group A or B) |
Turn the amber rows green
Work CSSLP questions by domain, starting with whatever the board marked HOLD or NO-GO, then tick again.
App StoreGoogle PlayFree CSSLP practice testFAQ
Can I take CSSLP without four years of experience?
Yes. ISC2 does not check experience before the exam. If you pass without the four years of full-time experience, you can become an Associate of ISC2 and then have five years to earn it before upgrading. A relevant bachelor's or master's degree can count for one year, and part-time work or internships may also count toward the total.
Is the CSSLP exam available online?
No. CSSLP is delivered only in English at Pearson VUE test centres. ISC2 says its online proctoring pilots did not meet its exam security standards, so plan for travel, two forms of ID, a palm vein scan and a 30-minute early arrival. Use the Pearson ISC2 test centre locator before buying to check seat availability near you.
Which CSSLP domain matters most?
Secure Software Architecture and Design is the heaviest at 15%, followed by Implementation and Testing at 14% each and Requirements at 13%. But no domain is worth more than 15% and the lightest, Supply Chain, is still 10%. That flat spread means breadth across all eight SDLC areas beats deep expertise in one, so close your weakest domain first.
What happens if I fail CSSLP?
You receive a proficiency level for each domain instead of a score, which tells you where to focus. You can retest after 30 test-free days, then 60 days after a second attempt and 90 after a third, with no more than four attempts in 12 months. Each attempt is paid unless you bought Peace of Mind Protection, which bundles two attempts.
Is the CSSLP outline about to change?
The current outline has been effective since 15 September 2023. ISC2 invited CSSLP holders to help with a job task analysis workshop it scheduled for early 2025, which is the process that leads to outline updates, but no new effective date had been announced by October 2026. Check the outline page on isc2.org for an effective date before you book.
Sources
Figures on this page come from ISC2 and the other primary sources below:
- ISC2 CSSLP Certification Exam Outline (effective 15 September 2023)
- ISC2 CSSLP certification page
- ISC2 exam pricing
- ISC2 After Your Exam (results, endorsement, retake policy)
- ISC2 Exam Day (ID, check-in, test centre rules)
- ISC2 Member Policies (CPE, AMF, Associate time limits)
- ISC2: Help Shape the CSSLP Exam (January 2025)
Checked October 14, 2026. Fees, outlines and eligibility rules change — confirm with ISC2 before you book.