CSLLP study plan — 8 weeks out, how are people structuring their time?
I'm sitting for the CSLLP in about 8 weeks and trying to figure out how to allocate my time across the 8 domains. I've got about 10 years in software development but my security governance and supply chain knowledge is weak. I'm currently averaging about 62% on practice questions which feels too low for where I should be this far out.
I've been going through the official CBK and spending about 2 hours each morning before work. The Secure Software Concepts and Secure Software Design domains feel comfortable since they map directly to my actual job. But Software Acceptance and Supply Chain and Component Management are killing me. Not sure if I should grind those two first or get everything to a baseline before going deep anywhere.
What's the actual passing score threshold? I've heard 700 out of 1000 but also seen people say it's scaled and varies by exam form. Does anyone know if certain domains are weighted more heavily? I've been treating them as equal but I'm not sure that's right.
Happy to share my full study schedule if anyone wants to compare notes. I'm targeting 75%+ on practice tests before I'd feel confident walking in.
The official practice exam from (ISC)² is worth buying. It's expensive but the question style matches the real exam better than most third-party materials. I'd score yourself on that before deciding you're ready.
I passed last year with about 9 weeks of prep at 90 minutes a day. The domains I came into with real experience I basically just reviewed. The ones I didn't use at work I went deep on. That split approach worked well.
700 scaled is the passing score. It's not a raw 70% — the scaling means some exam forms are slightly harder and the threshold adjusts. Hitting 75-80% consistently on practice questions correlates well with passing from what I've seen.
Supply Chain and Component Management is weighted around 10-12% so it's not massive, but you still need to know it. Don't neglect it.
62% at 8 weeks out is fine. I was at 58% at 6 weeks out and passed. Just be consistent and make sure you understand why wrong answers are wrong, not just what the right answer is.
62% honestly isn't as bad as it sounds at 8 weeks out, but yeah, supply chain is rough if you're coming from pure dev. The thing that helped me most wasn't grinding more questions -- it was forcing myself to explain why each wrong answer was wrong before moving on. Like actually say it out loud or type it out. I wasted two weeks just clicking through practice sets and my score barely budged.
For your weak domains, I'd spend extra time on the csllp/questions/supply chain and software acquisition questions and really dig into the distractors. ISC2 loves to give you two answers that both sound reasonable, and the difference is usually about scope or timing. Once I started understanding the "why wrong" piece, my score jumped about 8 points in like ten days. You've got time, just don't let the practice test become a pass/fail ritual instead of a learning tool.
I failed my first attempt at 62% so I know exactly where you're at. What killed me was treating all 8 domains equally when I should've been hammering the ones I was weakest in. Second time I spent almost 60% of my study hours on software supply chain and governance stuff, and honestly the csllp/questions/supply chain and software acquisition practice set was where things finally clicked for me because the questions forced me to think like a risk manager not just a developer.
With 10 years dev experience you're probably fine on the technical implementation side, so don't waste time reviewing stuff you already know. Your 62% is close enough that you're not missing fundamentals, you're likely missing the governance and legal framing that the exam loves to test. I'd aim to hit 72-75% consistently on practice sets before you sit again, and make sure you're doing timed sets so you don't run out of clock on the real thing.