topic Re: CCSP SDLC steps discrepancies between CBK & Official Study Guide (vol 2) versions in Exam Preparation

CCSP SDLC steps discrepancies between CBK & Official Study Guide (vol 2) versions

cyberdude — Mon, 09 Oct 2023 09:39:54 GMT

I'll be taking my CCSP in a couple of weeks, I'm hoping I can get help with the discrepancies between the CBK and the Official Study Guide (both from ISC2) as it pertains to the SDLC steps.

The CCSP Official Study Guide
Chapter 7 - Cloud-Secure Software Development Lifecycle (Pg 340-341 ebook)

1. Defining
2. Designing
3. Development
4. Testing
5. Secure Operations
6. Disposal

The Official (ISC)2 Guide to the CCSP CBK
Domain 4 - Cloud Application Security (Pg 213-214)

1. Planning and requirements analysis
2. Defining
3. Designing
4. Developing
5. Testing

Which one is correct? Which one should I concentrate on?
If a question is which one is the last step of SDLC, I can see getting this wrong.

Any help would be greatly appreciated.

Re: CCSP SDLC steps discrepancies between CBK & Official Study Guide (vol 2) versions

dcontesti — Sun, 18 Oct 2020 20:53:15 GMT

@AndreaMoore

Definitely something that should be raised to Casey and his crew.

As to an answer, that's a hard one.

I am not a CCSP so may be all wrong on this one but as a CSSLP, I would suggest that the Official study guide may be missing a few stages. I have always used a seven stage method:

Planning
Feasibility or Requirements
Design
Development
Testing
Implementation and Integration
Operations and Maintenance.

I typically group Disposal in the operations and maintenance phase.

However I have seen other folks use five and six phase approaches. But then I think the two documents should reflect the same steps.

Suggest we wait to see what (ISC)2 has to say on this one.

As to the exam, Testing is NOT the last phase no matter which model one uses.

Re: CCSP SDLC steps discrepancies between CBK & Official Study Guide (vol 2) versions

cyberdude — Mon, 19 Oct 2020 00:03:28 GMT

dcontesti,

Thank you for your reply. I appreciate it, specially as I plan on sitting for the CSSLP as well in March of next year. I don't have the CSSLP book yet and I was hoping that would be the "tie-breaker".

It sounds like adding the CSSLP then by all accounts ISC2 has a total of 3 different lifecycles for software development, which is understandable in real world scenario, but should not be the case for a single topic in an educational setting (but then again, what do I know about education.). 🙂

Re: CCSP SDLC steps discrepancies between CBK & Official Study Guide (vol 2) versions

JosE — Wed, 21 Oct 2020 08:29:02 GMT

In 2019 I followed the Firebrand training for CSSP and they follow the (ISC)2 CCSP CBK. Both lists overlap so I shouldn't worry.