Hello, you are using an old browser that's unsafe and no longer supported. Please consider updating your browser to a newer version, or downloading a modern browser.
This guide covers the CertNexus secure coding credential as of October 2026, including the five CSC-210 domains, the exam format and passing score, renewal by re-examination, DoD 8140 status, the newer CSSD track, and how CSC compares to CSSD and the ISC2 CSSLP. It is written for developers, testers and architects deciding whether to sit CSC-210.
CSC is the CertNexus certification for developers, testers and architects who need to show they can find and fix security flaws in the software they build.
The exam, CSC-210, has five domains. Four of them set up the work: security terminology, who owns what in a secure SDLC, architecture and design, and risk assessment. The fifth, Application Implementation, is 35 percent of the exam on its own. That one covers input validation, output handling, cryptography, authentication, logging, configuration and database access, which is why CSC reads like a test of what a developer does at the keyboard rather than a survey of the security field. It is vendor-neutral, so no single language or platform is assumed.
There are no formal prerequisites, and CertNexus lists the credential as DoD 8140 approved for use. CSC is issued and maintained by CertNexus. The official course is titled Certified Cyber Secure Coder, which is why you will also see it called CCSC. In 2026 CertNexus launched Cyber Secure Software Developer (CSSD) and says it is intended to succeed CSC, but CSC-210 remains on sale with no sunset date set.
Security principles, hacking terms, common flaws and attacks. 15% of the exam.
The secure SDLC and each role's deliverables, from architect to tester. 15%.
Abuse cases, threat modeling, design patterns, regulations. 18% of the exam.
OWASP Top 10, CWE Top 25, impact, likelihood and risk scoring. 17%.
Validation, crypto, auth, logging, config, database access. The heaviest domain at 35%.
Four things set CSC apart from the security certifications most developers are pointed toward.
More than a third of CSC-210 is Application Implementation, broken into eight objectives that each name a control you write: validate input, restrict output, implement crypto, implement authentication and access control, handle errors and logging, secure communications, configure security settings, and access the database safely. On most security exams that share of the questions goes to operations or governance, which tells you who CSC is written for.
CSC-210 has no application fee, no supporting documentation and no eligibility check. Compare that with CSSLP, which asks for four years of software lifecycle experience before you hold the full credential. A developer two years into the job can sit CSC now.
The exam tests concepts outside any one language. The blueprint covers secure storage on desktop, mobile, cloud, web servers and IoT devices, plus communication security for mobile apps on slow or unreliable networks and for IoT devices. A team shipping Java services and a team shipping a mobile app study the same material.
CertNexus states that Cyber Secure Coder is DoD 8140 approved for use. That matters for software work on federal and defense contracts, where people in cyber work roles have to meet DoD 8140 qualification requirements.
Which DoD Cyber Workforce Framework work roles CSC satisfies, and at what proficiency level, is set by the qualification matrix rather than by CertNexus. We are not listing individual work roles here because the matrix is revised periodically. Check the current version at the DoD Cyber Exchange before you rely on it for a specific billet.
The certification, the exam, and what it takes to keep CSC current, as CertNexus publishes them in October 2026.
CSC shows you can write and review code with security in mind. From there people usually move to the newer CertNexus track, widen out to the full software lifecycle, or learn to attack what they build.
Cyber Secure Software Developer, exam CSD-110, launched May 11, 2026. It is 25 items delivered online through the CHOICE platform, and CertNexus lists DevSecOps, AI-assisted development and software supply chain security among its topics. CertNexus says it is intended to succeed CSC.
The ISC2 secure software credential spans eight lifecycle domains over 125 items and asks for four years of experience. It is the usual step once your job grows from writing secure code to owning the secure SDLC. Read the full CSSLP guide.
Hands-on penetration testing from CompTIA, exam PT0-003. A good fit for CSC holders who want to test applications the way the tester in Objective 2.5 does, not only defend them. Read the full PenTest+ guide.
CSC is a practitioner credential for the build side of security. It sits on top of basic security and development skills and leads either toward owning the secure lifecycle or toward offensive testing.
Build the baseline
The practitioner step
Two questions to settle before you commit: are you ready to sit it, and should you pick CSC over the alternatives. Here is a straight answer to both.
You can register now.
CSC-210 has no formal prerequisites, no application fee and no eligibility check. CertNexus does recommend four things before you sit it: developing in more than one language and coding environment, building for web, cloud, mobile and desktop platforms, writing and analyzing use cases and specifications, and working with analysis, debugging, encryption and penetration testing tools. If most of that is your job already, buy a voucher and schedule.
You can sit it, but build the basics first.
Nothing stops you from registering. The exam still assumes you can read code and follow a design discussion, and its heaviest domain is about writing secure implementations. If you have not shipped software yet, learn a language and the security fundamentals first. Security+ covers the security side well, and CSC makes much more sense once you have written code that someone else depends on.
CertNexus aligns CSC with more than 20 roles across software development, security testing and code review, and architecture and technical leadership. These six are where it fits most directly.
Writes the features that take user input, store data and call other services. Application Implementation is 35 percent of CSC-210, and its eight objectives read like a developer's daily checklist: validation, output handling, crypto, authentication, logging, configuration and database access.
Sorts findings and decides what gets fixed first. Domain 4 covers that work directly: rating threats against the OWASP Top 10 and the CWE Top 25, weighing impact against likelihood, and scoring risk either by expected loss or with DREAD.
Writes the security test cases and runs the tools. Objective 2.5 names penetration testing, fuzzing, session management and client-side testing, with tools such as Metasploit, Nessus, ZAP and Nmap.
Reads pull requests for flaws before they merge. Objective 2.4 covers the reviewer's deliverables, vulnerability and QA reports, and both static and dynamic code analysis tools.
Sets the patterns a team builds on. Domain 3, at 18 percent, covers use and abuse cases, modular design that shrinks the attack surface, threat modeling with STRIDE and PASTA, and security design patterns.
Builds the checks into the pipeline. CSC-210 covers the secure SDLC models teams adopt, such as OWASP SAMM, ASVS and Microsoft SDL, separation of duties across coding, testing and deployment, and keeping security settings out of hard-coded values.
Three secure software credentials at three stages. CSC is the established CertNexus exam and CSSD is the newer track CertNexus intends to succeed it. CSSLP, from ISC2, sits a level up and waits on four years of experience. Here is how they line up.
| CSC | CSSD | CSSLP | |
|---|---|---|---|
| Issuer | CertNexus | CertNexus | ISC2 |
| Focus | Secure coding in your own code | The full secure SDLC, DevSecOps and supply chain | Building software securely across the lifecycle |
| Exam and Status | CSC-210, launched March 2020, sunset TBD | CSD-110, launched May 11, 2026 | Outline effective September 15, 2023 |
| Domains | 5, implementation is 35% | 5, secure coding is 33% | 8, following the SDLC |
| Exam Format | 80 items, 120 min, MC and MR | 25 items, est. 30 to 60 min, MC and MR | Linear, 125 items, 3 hrs |
| Passing Score | 60% | 80% (20 of 25) | 700 / 1000 |
| Delivery | Pearson VUE center or OnVUE | Online through the CHOICE platform | Pearson VUE test center |
| Experience | None required | None required | 4 yrs in 1+ CSSLP domain |
| Exam Cost | $367.50 USD voucher | Sold as a course access key | ~$599 USD |
| Renewal | Retake the current exam within 3 years | Not stated in the blueprint | 90 CPEs over 3 years |
| DoD 8140 Approved | Yes, approved for use | Not stated by CertNexus | Yes |
| Best For | Developers who want a secure coding credential now | Teams starting fresh on the newer CertNexus track | Experienced staff who own the secure SDLC |
CSSD is new and CertNexus has published less about it so far, so check its exam page before you plan around its renewal terms or DoD use. CSSLP prices and renewal terms vary by region and membership status. The practical difference is experience. CSC and CSSD need none, and CSSLP needs four years.
Certification Matchups: the published facts, strengths and weak spots of 33 certifications, side by side.
Our three-day CertNexus Cyber Secure Coder boot camp is live and instructor-led, in person or online, and uses official CertNexus courseware. Your CSC-210 exam voucher and a free retake are included, and you sit the exam on site at the end of class.
Studying from the blueprint, the flaws secure code is meant to stop, developer certifications, DoD 8140, and the coding versus security career question.
How to read a blueprint's domains, weights and verbs, then turn them into a study plan. Worth doing for CSC-210, where one domain is 35 percent of the exam and older blueprint copies still circulate.
Flaws that sat in production code for decades, found by an AI model in 2026. What that means for the people who write and review code for a living.
The OWASP list published in December 2025 for AI agents that plan, call tools and act with delegated authority. A useful companion to the OWASP material that runs through CSC-210.
Code that travels from a remote source and runs on the user's machine, why it creates risk, and how organizations control it. Background for the client-side topics in CSC-210.
All six GitHub exams, including the rewritten GH-500 Advanced Security exam on Secret Protection, Code Security with CodeQL and supply chain security. A tool-specific complement to vendor-neutral CSC.
How a certification earns a place on the DoD 8140 qualification matrix, and why approval is judged one work role at a time.
A straight comparison of the two kinds of bootcamp and the job markets behind them, for developers weighing a move toward security work.
The CSC-210 blueprint organizes the exam into five domains, each carrying its own weight. Application Implementation alone is more than a third of the test. Click any domain for what it covers.
The vocabulary the rest of the exam assumes. Encryption with public keys, private keys and hashes, the CIA triad, AAA, least privilege, least common mechanism, defense in depth, fail safe, weakest link, separation of duties and monitoring. It also covers hacking terms and the common flaw classes, from missing input validation and insecure deserialization to attacks such as SQL injection, XSS, XXE, buffer overruns and remote code execution.
Who does what in a secure SDLC. The lifecycle phases and the models teams adopt (OWASP SAMM, OWASP ASVS, the OWASP Top 10 Proactive Controls, the OWASP Mobile Security Project and Microsoft SDL), then the security deliverables of the architect, the developer, the code reviewer with static and dynamic analysis tools, and the tester running penetration tests, fuzzing and tools such as Metasploit, Nessus, ZAP and Nmap.
Designing the flaw out before it is written. Use and abuse cases, modular design that shrinks the attack surface, threat modeling with Microsoft STRIDE and PASTA, software and security design patterns, identity management and logging design, regulations such as HIPAA, PCI DSS, ISO 27001, SOX and GDPR, and the internal policies for passwords, authentication, secure storage and disposal of development assets.
Deciding which flaws matter most. Classifying threats against the OWASP Top 10 and the CWE Top 25, the assets at stake, threat actors from script kiddies to foreign governments, countermeasures, impact and likelihood. Quantitative scoring (expected loss equals impact times probability) and qualitative scoring with Microsoft DREAD, plus policy updates and architectural review.
The heaviest domain by a wide margin, with eight objectives. Input validation, restricting sensitive output, cryptography and key management, authentication and access control with session management and lockouts, error handling and logging, communication security over TLS, SSH and IPsec, security settings without hard-coded values, and secure database access with parameterized queries and stored procedures.
Domains and weights reflect the CertNexus Cyber Secure Coder (CSC-210) Exam Blueprint version 1.3, modified January 31, 2023, the version CertNexus sells vouchers against today.
The questions candidates ask most often when researching the CertNexus Cyber Secure Coder certification.
Cyber Secure Coder (CSC) is a vendor-neutral CertNexus certification for people who build software. It tests whether you can find and fix security flaws across the development lifecycle, from design through implementation and testing, in any language or platform. The current exam is CSC-210. The official course is titled Certified Cyber Secure Coder, so you will also see the credential called CCSC.
CertNexus designs CSC for software developers, testers and architects who build for desktop, web, cloud and mobile platforms. It also fits code reviewers, application security analysts, QA testers and DevSecOps engineers. It is a practitioner credential, so it suits people who already write or test code more than people who are brand new to IT.
The CSC-210 exam voucher costs $367.50 USD in the CertNexus store as of October 2026. Every CertNexus voucher includes one free retake, and vouchers expire 18 months after purchase. Many training programs bundle the voucher into the course price, so check what is included before you buy one separately.
CSC-210 has 80 multiple choice and multiple response questions and a 120-minute time limit, which includes 5 minutes for the Candidate Agreement and 5 minutes for the Pearson VUE tutorial. You need 60 percent to pass. You can sit it at a Pearson VUE test center or online through Pearson OnVUE. Passing candidates are told only that they passed, while failing candidates get feedback by domain.
No. CSC-210 has no formal prerequisites, no application fee and no eligibility check. CertNexus does recommend that you can develop in multiple languages and coding environments, build for web, cloud, mobile and desktop, write and analyze use cases and specifications, and use analysis, debugging, encryption and penetration testing tools before you sit it.
The passing score is 60 percent, according to the CertNexus Cyber Secure Coder page and version 1.3 of the CSC-210 blueprint, modified January 31, 2023. Older copies of the blueprint from January 2020 list 70 percent and test-center-only delivery. Go by version 1.3, which also adds Pearson OnVUE online proctoring.
The five domains are Common Secure Application Development Terminology and Concepts at 15 percent, Job and Process Responsibilities Related to Secure Application Development at 15 percent, Architecture and Design at 18 percent, Risk Assessment and Management at 17 percent, and Application Implementation at 35 percent. Application Implementation carries more than a third of the exam.
CSC is valid for three years from the date it is granted. To keep it valid without a gap, you retake and pass the most recent version of the exam before the three years run out. CertNexus runs a continuing education program for some of its certifications, but CSC is not on that list, so the exam retake is the renewal route CertNexus states for CSC.
Yes. CertNexus states that Cyber Secure Coder is DoD 8140 approved for use. Which DCWF work roles it covers, and at which proficiency level, is set by the DoD 8140 qualification matrix rather than by CertNexus, so check the current matrix at the DoD Cyber Exchange before relying on it for a specific role.
CertNexus says Cyber Secure Software Developer (CSSD) is intended to succeed CSC. CSSD launched May 11, 2026 as exam CSD-110, with 25 items delivered online through the CHOICE platform. CSC-210 has not been retired, and its sunset date is listed as TBD. CertNexus invites CSC candidates to contact it about the transition path from CSC to CSSD, which is worth doing before you plan a renewal.
CSC is a CertNexus practitioner exam about writing secure code, with 80 questions, a 60 percent passing score and no experience requirement. CSSLP is an ISC2 credential about owning security across the whole software lifecycle, with 125 items and four years of required experience in its domains. If you write code and want a credential this year, CSC is the closer fit. CSSLP makes more sense once you own the secure SDLC for a team and have the four years to back it up.
If you write, test or review code and want a credential that tests secure coding directly, CSC is a reasonable choice. It has no experience gate, CertNexus lists it as DoD 8140 approved for use, and more than a third of the exam is about implementation. The main caution is timing, since CertNexus has launched CSSD as its intended successor. If you would rather certify on the newer track, look at CSSD before you buy a CSC-210 voucher.
Whether you are weighing the certification, working out funding, or planning secure coding training for a development team, tell us where you are and we will help you map out the right path.