Course details

CSSLP: Supply Chain and Software Acquisition

CSSLP: Supply Chain and Software Acquisition

Target Audience
Expected Duration
Lesson Objectives
Course Number
Expertise Level

Software lifecycle activities regularly extend beyond the internal environment. Outsourced software development, acquisition, and procurement activities require specific attention to ensure security is integrated into the end software product or service. In this course, you'll learn about supplier risk assessment considerations, including intellectual property, code reuse, and legal compliance complexities. This course also introduces some considerations to make with supplier sourcing like contractual integrity controls, vendor technical integrity controls, and service-level agreements or SLAs. Finally, this course also introduces software delivery and maintenance best practices like publishing and dissemination controls, product deployment and sustainment controls, and supplier transitioning requirements. This course is one of a series in the Skillsoft learning path that covers the objectives for the Certified Secure Software Lifecycle Professional or CSSLP exam.

Target Audience
Individuals interested in secure software lifecycle design concepts and methodologies; candidates for the Certified Secure Software Lifecycle Professional (CSSLP) exam


Expected Duration (hours)

Lesson Objectives

CSSLP: Supply Chain and Software Acquisition

  • start the course
  • recognize characteristics of risk assessment for code reuse
  • identify best practices for creating a practical reuse plan
  • identify best practices for preventing intellectual property theft
  • recognize characteristics of legal compliance
  • identify best practices for supplier prequalification activities
  • distinguish between different security trade-offs in supplier sourcing
  • identify best practices for contractual integrity controls
  • identify best practices for vendor technical integrity controls
  • identify best secure control practices for managed services from a supplier
  • distinguish between the two rules service-level agreements or SLAs should provide
  • identify technical controls for software development and testing
  • identify code testing and verification options for software development and testing
  • list the eight steps to create a formal set of security testing controls
  • identify software requirements verification and validation
  • identify chain of custody best practices
  • distinguish between licenses, encryption, and authentication as publishing and dissemination controls
  • identify characteristics of system-of-systems integration
  • identify software authenticity and integrity best practices during software delivery, operations, and maintenance
  • recognize best practices when integrating product deployment and sustainment controls
  • identify monitoring and incident management best practices
  • identify best practices for vulnerability management, tracking, and resolution activities
  • identify the purpose of Code Escrow during supplier transitioning
  • identify contracts best practices during supplier transitioning
  • identify best practices for assessing supplier risk, implementing supplier sourcing controls, and delivering software
  • Course Number:

    Expertise Level