1 unchanged sentence
CYBERSECURITY
−Removed: We recognize the critical importance of maintaining the safety and security of our systems and data, and have a holistic approach for overseeing and managing cybersecurity and related risks.
+Added: We recognize the critical importance of maintaining the safety and security of our systems and data and have a comprehensive approach to overseeing and managing cybersecurity and related risks.
Our Board of Directors (the “Board”), the Audit Committee of the Board (the “Audit Committee”), and our management are actively involved in the oversight of our risk management program, of which cybersecurity represents an important component.
We have established policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats.
−Removed: A key component of this is our standing Security Steering Group (“SSG”) whose members include, among others, our Chief Information Security Officer (“CISO”), Chief Product Officer, and Chief Technical Systems Officer.
+Added: A key component of this is our standing Security Steering Group (“SSG”), whose members include, among others, our Chief Information Security Officer (“CISO”), Chief Product Officer, and Vice President of Cloud Technology .
We have devoted significant financial and personnel resources to implement and maintain security measures to meet regulatory requirements and customer expectations, and we intend to continue to make significant investments to maintain the security of our data and cybersecurity infrastructure.
1 unchanged sentence
Although we are not aware of having experienced any prior material data breaches, regulatory non-compliance incidents, or cyber security incidents, we may in the future be impacted by such an event, exposing our clients and us to the risk of someone obtaining access to our information, to the information of our clients or their customers, or to our intellectual property, disabling or degrading service, or sabotaging systems or information.
−Removed: Any such security breach could result in a loss of confidence in the security of our services, damage our reputation, disrupt our business, require us to incur significant costs of investigation, remediation, and/or payment of a ransom, lead to legal liability, negatively impact our future sales, and result in a substantial financial loss.
+Added: Any such security incident could result in a loss of confidence in the security of our services, damage our reputation, disrupt our business, require us to incur significant costs of investigation, remediation, and/or payment of a ransom, lead to legal liability, negatively impact our future sales, and result in a substantial financial loss.
For additional information, see "Item 1A.
7 unchanged sentences
Risk Assessment
−Removed: Our cyber risk management program is designed to follow the ISO 31000 and the NIST Special Publication 800-37 frameworks and is in the scope of our ISO 27001 certifications.
+Added: Our cyber risk management program is designed to follow the ISO 31000 and the NIST Special Publication 800-37 frameworks and is within the scope of our ISO 27001 certifications.
At least annually, we conduct cybersecurity risk assessments that consider information from internal stakeholders, known information security vulnerabilities, and information from external sources, such as reported security incidents that have impacted other companies, industry trends, and evaluations by third parties and consultants.
5 unchanged sentences
Incident Response and Recovery Planning
−Removed: We have implemented Cyber Incident Response Programs, which are in the scope of our ISO 27001 certifications.
−Removed: We have also implemented Business Continuity Programs, which are in the scope of our ISO 22301 certification.
+Added: We have implemented Cyber Incident Response Programs, which are within the scope of our ISO 27001 certifications.
+Added: We have also implemented Business Continuity Programs, which are within the scope of our ISO 22301 certification.
We have established comprehensive incident response and recovery plans and test and evaluate the effectiveness of those plans regularly.
Third-Party Risk Management
−Removed: We have implemented a Vendor Cybersecurity Risk Management Program (“VCRMP”), which is in the scope of our ISO 27001 certifications.
+Added: We have implemented a Vendor Cybersecurity Risk Management Program (“VCRMP”), which is within the scope of our ISO 27001 certifications.
The VCRMP controls are designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers.
8 unchanged sentences
Corporate Security Posture
−Removed: We periodically conduct independent security assessments to assess its security posture and to inform where cyber security investments should be made.
−Removed: For systems in our corporate environment on which our cloud certifications have an operational dependency, we also maintain ISO/IEC 27001 certifications relating to overall IT processes and controls and ISO 22301 certification relating to business continuity.
+Added: We periodically conduct independent security assessments to assess our corporate environment’s security posture and inform where cyber security investments should be made.
+Added: For systems in our corporate environment where our cloud certifications have an operational dependency, we also maintain ISO/IEC 27001 certifications relating to overall IT processes and controls and ISO 22301 certification relating to business continuity.
Product Security Posture
7 unchanged sentences
Redacted versions of these reports are made available to our clients.
−Removed: Pega Cloud also maintains several security certifications, which are listed at http://pega.com/trust which is included as an inactive reference and the content of which is not incorporated by reference into this Annual Report.
+Added: Pega Cloud also maintains several security certifications, which are listed at https://pega.com/trust, which is included as an inactive reference and the content of which is not incorporated by reference into this Annual Report.
Pega Cloud for Government is rated FedRAMP Moderate and undergoes several security assessments a year as part of the FedRAMP certification process.
−Removed: Our Chief Technical Systems Officer reviews these assessments and provides updates to our SSG.
+Added: Our Vice President of Cloud Technology reviews these assessments and provides updates to our SSG.
Board Oversight
−Removed: As part of our corporate governance process, the Board, along with the Audit Committee, oversees our risk management process, which includes cybersecurity and related risks.
+Added: As part of our corporate governance process, the Board, along with the Audit Committee, oversee our risk management process, which includes cybersecurity and related risks.
Our CISO periodically meets with the Board and Audit Committee to inform and update them on our cybersecurity program.
SSG and Key Personnel
−Removed: We have a standing SSG whose members include, among others, our CISO, Chief Product Officer, and Chief Technical Systems Officer.
+Added: We have a standing SSG whose members include, among others, our CISO, Chief Product Officer, and Vice President of Cloud Technology.
The SSG is charged with providing strategic direction for the implementation and ongoing operation of our cyber security program.
1 unchanged sentence
Our CISO chairs the SSG and decisions and recommendations are based on a consensus of the members.
−Removed: Our CISO has twenty years of professional experience, with eleven years specifically in information security roles.
−Removed: He has been with Pega for four years and has a Master of Science degree from Northwestern University.
−Removed: Our Chief Product Officer has been with Pega for thirty-one years, has extensive experience in software development, and has a Bachelor of Science from the Indiana University of Pennsylvania.
−Removed: Our Chief Technical Systems Officer has been with Pega for six years and has twenty-five years of technology management experience, with thirteen years of leadership roles in cloud services and related information security issues, and served in the U.S.
−Removed: Navy and holds a degree in Business Administration from the College of Technology at the State University of New York – Farmingdale.
+Added: Our CISO has over twenty years of professional experience, with twelve years in information security roles.
+Added: He has been with Pega for five years and has a Master of Science degree from Northwestern University.
+Added: Our Chief Product Officer has been with Pega for thirty-two years, has extensive experience in software development, and has a Bachelor of Science from the Indiana University of Pennsylvania.
+Added: Our Vice President of Cloud Technology has been with Pega for seven years and has twenty-five years of networking and security management experience, with seventeen years of leadership roles in cloud services and related information security issues.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.