CSSLP - Certified Secure Software Lifecycle Professional

Who this certification is designed for

The vendor’s stated audience, plus an honest fit for your starting point. No pass rates, no guarantees.

Per ISC2: 4 years required work experience. ISC2 Cybersecurity Certifications · checked 2026-07-07

General funding research checklist: vouchers, WIOA, Workforce Pell, GI Bill, and employer education assistance may be worth checking. This list is not evidence that this credential, exam, or provider qualifies; confirm eligibility with the official program before relying on funding. Compare funding options →

Exam at a glance

How ISC2 administers the exam — the logistics only. This is format, not a pass prediction, and it says nothing about how hard the material is for your background.

Format

Multiple choice and advanced item types

Duration

3 hours

Languages

English

Testing provider

Pearson VUE (test centers)

Delivery

ISC2 exams are taken at Pearson VUE testing centers worldwide — there is no take-at-home option.

Online proctoring

Because ISC2 exams are taken at Pearson VUE test centers, home-proctoring setup does not apply — bring a valid government photo ID; the center provides the secured testing environment.

Policies change; verify delivery, ID, room-scan, reschedule, and refund rules on the official page before you book or pay. See exam-day logistics →

Skills measured

Vendor-published objective domains and exam weights, normalized for display; use the cited official objectives for exact wording. CSSLP - Certified Secure Software Lifecycle Professional — official vendor page · checked 2026-06-08

Where the U.S. Department of Defense accepts this

The DoD lists this certification as an approved foundational qualification option for 5 cyber work roles, per the DoD 8140 qualification matrix (V2.1, effective 2025-09-19; checked 2026-08-07). These are work-role classifications, not job openings, not hiring eligibility, and not evidence that these roles are available to you.

This covers the foundational step only. DoD 8140 qualification has more than one part: a foundational qualification, then a resident on-the-job qualification within the role, then continuing professional development. A certification can satisfy the foundational part. It does not by itself qualify anyone for the work role.

It is also one route, not the required one. The DoD lists a qualifying degree, approved training, or a certification as alternatives to the same foundational baseline. And a certification approved at a higher proficiency level also applies at lower proficiency levels for that same work role, so the level shown above is where the matrix maps it, not a ceiling.

The matrix sets the department-wide baseline. A component, command, or contract may set stricter foundational requirements for a particular position, and environment-specific resident requirements are left to component discretion — so this cannot tell you what one specific job will ask for. Sources: the DoD 8140 qualification matrix V2.1 (XLSX) for the mappings, and DoDM 8140.03 (PDF) for the qualification lifecycle. IAT, IAM and IASAE levels belong to DoD 8570.01-M, which DoDM 8140.03 cancelled, and are not part of 8140.