How I Passed the CSSLP — My Experience in 2025
After passing the CISSP earlier this year, I decided to follow it up with the Certified Secure Software Lifecycle Professional (CSSLP) certification. For those unfamiliar, CSSLP is an ISC2 certification that focuses specifically on secure software development practices across the full SDLC—from requirements and design to coding, testing, deployment, and maintenance.
Where the CISSP is broad, the CSSLP is laser-focused. This exam dives deep into secure software principles, threat modeling, data protection, API security, database hardening, and development methodologies like Agile, DevOps, and DevSecOps. It’s not just for coders—it’s for anyone who wants to lead or contribute to building secure software systems in a world where security is no longer optional.
Why I Took the CSSLP
I’ve been involved in web and app development since 2009. I’ve launched iOS apps, built and deployed dozens of websites, and been part of product teams at various stages—from startup MVPs to enterprise-grade platforms. As my career has evolved, I’ve found myself increasingly leading DevOps and security conversations, working to ensure that security is baked in, not bolted on.
The CSSLP was my way of formalizing those skills. I wanted to demonstrate not just that I can write code, but that I can lead secure development efforts, manage cross-functional teams, and make decisions that protect both users and businesses.
How I Prepared
Here’s what worked for me:
📘 Read the Official ISC2 CBK for CSSLP — It’s dry but comprehensive. I read it cover to cover to ensure no domain slipped through the cracks.
📗 All-In-One CSSLP Exam Guide by McGraw Hill — Easier to digest and a great companion to the CBK.
🎧 Listened to the audiobook Essential CSSLP Exam Guide (2nd Edition) by Phil Martin — Fantastic for commuting or passive review.
🎥 Pluralsight CSSLP Exam Prep by Kevin Henry — I always find Kevin’s teaching style solid. It’s a good secondary resource.
📱 Pocket Prep CISSP iOS App (with CSSLP question set) — Surprisingly helpful. Great for quick quiz sessions and reinforcing weaker domains.
Study Tips, Tricks & Mental Prep
A few things I picked up from Reddit and the CSSLP community:
- Understand the “why,” not just the “what.” This exam wants you to think like someone designing secure systems from the ground up, not just checking boxes.
- Think like a security lead in a dev team. You’re not just fixing code—you’re preventing risk early.
- Practice threat modeling scenarios. Visualizing workflows and thinking about data flow, trust boundaries, and attack surfaces helps immensely.
- Get good at eliminating wrong answers. Like the CISSP, some questions will feel vague. Learn to rule out two obviously wrong options quickly.
- Mentally prepare to sit for a long exam. It’s 3 hours of intense focus. Don’t underestimate the mental load. Get rest the night before and stay hydrated.
Real-World Relevance
This wasn’t just a checkbox for me. The CSSLP aligns directly with the work I do—and want to do more of. It validated my experience with:
✅ Secure SDLC design and integration
🔐 Data classification, protection, and access control
🧰 DevOps/DevSecOps processes and tooling
🧱 Database design and hardening techniques
📄 Policy, governance, and compliance as they relate to development
With this under my belt, I feel more confident leading secure development teams, making risk-based decisions, and aligning product goals with security from day one.
If you’re considering the CSSLP, feel free to reach out or drop a comment. Happy to share more about my experience and help you prep!
Final Thoughts
Achieving the CSSLP certification has been a rewarding and enriching experience. It not only enhanced my technical understanding of secure software practices but also gave me a clearer perspective on how to integrate security seamlessly throughout the entire development lifecycle. With the increasing focus on security, it’s essential that developers, security leads, and engineers work together to build secure software from day one. I’m excited to continue applying these best practices and share the knowledge with the teams I work with.
Sources
For those interested in the resources I used during my preparation, here are the direct links:
- 📘 Official ISC2 Guide to the CSSLP CBK: Amazon
- 📗 CSSLP Certification All-in-One Exam Guide: Amazon
- 🎧 Essential CSSLP Exam Guide (2nd Edition) by Phil Martin (Audiobook): Audible
- 🎥 Kevin Henry’s CSSLP Exam Prep videos on Pluralsight: Pluralsight
- 📱 Pocket Prep CISSP iOS app (with CSSLP question set): App Store
#CSSLP #DevSecOps #SecureSoftware #ISC2 #CyberSecurity #SoftwareDevelopment #Certifications
AI Usage Transparency Report
AI Era · Written during widespread use of AI tools
AI Signal Composition
Score: 0.33 · Moderate AI Influence
Summary
The CSSLP certification is a valuable asset for developers, security leads, and engineers who want to build secure software from day one.
Related Posts
Setting up Ollama on macOS
Recently, after some bad experiences with OpenAI's ChatGPT and CODEX, I decided to look into and learn more about running local AI models. On its face it was intimidating, but I had seen a lot of people in the MacAdmins community posting examples of macOS setups, which really helped lower the bar for me both in terms of approachability and just making me more aware of the local AI community that exists out there today.
AI Agent Constraints and Security
I really feel like in this era of AI it's essential to write about and share experiences for others who are leveraging AI, especially now that AI usage seems almost ubiquitous. Specifically, when it comes to AI in development and the rapid growth of AI-driven automations in the IT landscape, I believe there's a need for open discussion and exploration.
Vibe Coding with Codex: From Fun to Frustration
So there I was, a typically day, a typical weekend. As a ChatGPT customer, I had heard good things about Codex and had not yet tried the platform. To date my experience with agentic coding was simply snippit based support with ChatGPT and Gemeni where I would ask questions, get explanations and support with squashing bugs in a few apps that I work on, for fun, on the side. There were a few core features in one of the apps I built that I wanted to try implementing but the...
Turn Jamf Compliance Output into Real Audit Evidence
Most teams use Apple’s macOS Security Compliance Project (mSCP) baselines because they scale and they’re repeatable. Jamf’s tooling makes deployment straightforward and the Extension Attribute (EA) output is a convenient place to capture drift. What you don’t automatically get is the artifact an auditor will accept on a specific date—an actual document you can file that shows which endpoints are failing which items, plus a concise roll-up of failure counts you can act on. Smart Groups answer scope; they don’t produce evidence.
Good Cybersecurity policies, procedures, guidelines take time. They're not rushed and aren't rubber stamped
Cybersecurity is no longer a luxury or an afterthought—it's an absolute necessity. But how can you tell if the company you work for, as a security professional, truly values cybersecurity? Let's explore some clear indicators that demonstrate a company's commitment to implementing robust security practices in-house. A genuine commitment will be reflected in the organization's policies and procedures, which should be regularly reviewed and updated to address emerging threats.
Managing Bring Your Own Device (BYOD) for Android with Microsoft Intune
Alright, so today we're going to be talking about the management of bring your own device BYOD for Android devices. There's a lot of information out there for the management of iOS devices and you can do that with pretty much any Apple MDM on the market. We just happen to use Jamf where I work, but you could use anything from Braavos to SimpleMDM to Kanji or JumpCloud. Mosyle is also a great option.
BYO with me in 2025: iOS with User Enrollment in JAMF Pro
It really depends on your company's needs. For example, many companies need to hire 1099 contractors and in such a case they come with their own devices but not the correct security settings or enforcements. Remember BYOD is a security construct. The idea here is that you should be securing the company's sensitive data in all forms. This may involve implementing policies for contractor-owned devices, ensuring that all devices accessing company data meet minimum security standards, and regularly reviewing and updating these standards to stay ahead of emerging threats.
Securing BYOD Email Access: Exploring Strategies in Microsoft 365
In today’s mobile-first world, organizations increasingly rely on Bring Your Own Device (BYOD) programs to empower employees while optimizing costs. However, this flexibility introduces unique challenges, particularly around securing email access. To mitigate risks, we are implementing a comprehensive strategy to block email access on non-company devices by default and ensure only sanctioned apps can access organizational email accounts. This approach will help prevent unauthorized access and data breaches, aligning with our commitment to maintaining the security and integrity of company communications.
How I Conquered the CISSP Exam: 9 Months, Top Resources, and Proven Strategies
Passing the CISSP (Certified Information Systems Security Professional) exam is no small feat. It’s known for its breadth, depth, and ability to test not just your knowledge but your practical understanding of cybersecurity. After nine months of intense preparation, I’m thrilled to say I’ve joined the ranks of CISSP-certified professionals! Here's a detailed account of my experience, including the resources I used, some tips that helped me along the way, and what I learned from the process itself.
Enhancing Cybersecurity on macOS: Empowering Users for a Safer Digital Journey!
macOS has earned a strong reputation for built-in security, but the real value of the platform is not just that protections exist. It is that Apple continues pushing the operating system toward more context-aware security decisions that help users make better choices before a problem becomes a breach. This approach allows users to understand and mitigate potential risks in real-time, rather than simply reacting to threats after they've occurred.
