2 unchanged sentences
We recognize the critical importance of maintaining the safety and security of our systems and data and have a comprehensive approach to overseeing and managing cybersecurity and related risks.
−Removed: Our Board of Directors (the “Board”), the Audit Committee of the Board (the “Audit Committee”), and our management are actively involved in the oversight of our risk management program, of which cybersecurity represents an important component.
+Added: Our Board of Directors (the “Board”), the Risk Subcommittee of the Audit Committee of the Board (the “Risk Subcommittee”), and our management are actively involved in the oversight of our risk management program, of which cybersecurity represents an important component.
We have established policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats.
−Removed: A key component of this is our standing Security Steering Group (“SSG”), whose members include, among others, our Chief Information Security Officer (“CISO”), Chief Product Officer, and Vice President of Cloud Technology .
+Added: A key component of this is our standing Security and Quality Steering Group (“SQSG”), whose members include, among others, our Chief Information Security Officer (“CISO”), Chief Product Officer, and Vice President of Cloud Technology .
We have devoted significant financial and personnel resources to implement and maintain security measures to meet regulatory requirements and customer expectations, and we intend to continue to make significant investments to maintain the security of our data and cybersecurity infrastructure.
9 unchanged sentences
We have implemented a governance structure and processes to aggregate reported cybersecurity risks on behalf of Pega Cloud, Pega’s software products, and the corporate environment.
−Removed: Our SSG is responsible for providing strategic direction for implementing and maintaining our cyber risk management program.
+Added: Our SQSG is responsible for providing strategic direction for implementing and maintaining our cyber risk management program.
Risk Assessment
−Removed: Our cyber risk management program is designed to follow the ISO 31000 and the NIST Special Publication 800-37 frameworks and is within the scope of our ISO 27001 certifications.
+Added: Our cyber risk management program is designed to follow the ISO 31000, NIST SP 800-37, and NIST SP 800-53 frameworks and is within the scope of our ISO 27001 certifications.
At least annually, we conduct cybersecurity risk assessments that consider information from internal stakeholders, known information security vulnerabilities, and information from external sources, such as reported security incidents that have impacted other companies, industry trends, and evaluations by third parties and consultants.
−Removed: The results of the assessments are provided to our SSG and are used to drive alignment on, and prioritization of, initiatives to enhance our security controls, make recommendations to improve processes, and inform our broader enterprise-level risk assessment.
−Removed: Key findings of these assessments are periodically presented to the Board and the Audit Committee.
+Added: The results of the assessments are provided to our SQSG and are used to drive alignment on, and prioritization of, initiatives to enhance our security controls, make recommendations to improve processes, and inform our broader enterprise-level risk assessment.
+Added: Key findings of these assessments are periodically presented to the Board and the Risk Subcommittee.
Technical Safeguards
13 unchanged sentences
We require all employees to participate in security awareness training, including frequent phishing tests.
−Removed: Currently, our mandatory employee training courses include Security Awareness, Physical Security Awareness, Mobile Device Security, Business Continuity and Phishing, Work From Home, and AI Chatbot.
+Added: Currently, our mandatory employee training courses include Security Awareness, Physical Security Awareness, Mobile Device Security, Business Continuity and Phishing, Work From Home, and AI Use.
In addition, all of our employee software developers are required to take additional security awareness training, currently including Secure Development.
4 unchanged sentences
Product Security Posture
−Removed: To facilitate identification of security vulnerabilities in our products, we periodically conduct third party penetration tests and participate in the independent Verified By Veracode program, as detailed on its website (https://www.veracode.com/verified/directory/pegasystemsInc) which is included as an inactive reference and the content of which is not incorporated by reference into this Annual Report .
+Added: To facilitate identification of security vulnerabilities in our products, we periodically conduct third party penetration tests and participate in the independent Verified By Veracode program.
We also generate a monthly software bill of materials that identifies open source included in certain of our product offerings and periodically have an independent security assessment firm evaluate the security risks linked to suppliers we use, including source code repositories, the infrastructure employed for software development, and the mechanisms used for software delivery, such as Amazon Web Services (“AWS”), Google Cloud, and Microsoft Azure.
−Removed: Our Chief Product Officer reviews these findings and provides updates to our SSG.
+Added: Our Chief Product Officer reviews these findings and provides updates to our SQSG.
+Added: Our AI products maintain an ISO/IEC 42001:2023 certification, an international standard for establishing, implementing, maintaining, and improving an Artificial Intelligence Management System (AIMS) to ensure responsible, ethical, and trustworthy AI use.
+Added: Certification helps to validate our commitment to managing AI risks (like bias, privacy, and security), enhances stakeholder trust, and provides a structured framework for AI governance.
+Added: We make Software Bill of Materials (“SBOM”) for products under standard support available to clients, listing the components of our software, providing clients transparency into open-source risk.
We regularly release new versions of our products to address identified security vulnerabilities, enabling clients to stay updated with the latest product releases.
3 unchanged sentences
Redacted versions of these reports are made available to our clients.
−Removed: Pega Cloud also maintains several security certifications, which are listed at https://pega.com/trust, which is included as an inactive reference and the content of which is not incorporated by reference into this Annual Report.
−Removed: Pega Cloud for Government is rated FedRAMP Moderate and undergoes several security assessments a year as part of the FedRAMP certification process.
−Removed: Our Vice President of Cloud Technology reviews these assessments and provides updates to our SSG.
+Added: Pega Cloud also maintains several security, quality, and industry certifications, which are listed at https://pega.com/trust, which is included as an inactive reference and the content of which is not incorporated by reference into this Annual Report.
+Added: Pega Cloud for Government is rated FedRAMP High and undergoes several security assessments a year as part of the FedRAMP certification process.
+Added: Our Vice President of Cloud Technology reviews these assessments and provides updates to our SQSG.
Board Oversight
−Removed: As part of our corporate governance process, the Board, along with the Audit Committee, oversee our risk management process, which includes cybersecurity and related risks.
−Removed: Our CISO periodically meets with the Board and Audit Committee to inform and update them on our cybersecurity program.
−Removed: SSG and Key Personnel
−Removed: We have a standing SSG whose members include, among others, our CISO, Chief Product Officer, and Vice President of Cloud Technology.
−Removed: The SSG is charged with providing strategic direction for the implementation and ongoing operation of our cyber security program.
−Removed: The SSG meets at least quarterly.
−Removed: Our CISO chairs the SSG and decisions and recommendations are based on a consensus of the members.
−Removed: Our CISO has over twenty years of professional experience, with twelve years in information security roles.
−Removed: He has been with Pega for five years and has a Master of Science degree from Northwestern University.
−Removed: Our Chief Product Officer has been with Pega for thirty-two years, has extensive experience in software development, and has a Bachelor of Science from the Indiana University of Pennsylvania.
−Removed: Our Vice President of Cloud Technology has been with Pega for seven years and has twenty-five years of networking and security management experience, with seventeen years of leadership roles in cloud services and related information security issues.
+Added: As part of our corporate governance process, the Board, along with the Risk Subcommittee, oversee our risk management process, which includes cybersecurity and related risks.
+Added: Our CISO periodically meets with the Board and Risk Subcommittee to inform and update them on our cybersecurity program.
+Added: SQSG and Key Personnel
+Added: We have a standing SQSG whose members include, among others, our CISO, Chief Product Officer, and Vice President of Cloud Technology.
+Added: The SQSG is charged with providing strategic direction for the implementation and ongoing operation of our cyber security program.
+Added: The SQSG meets at least quarterly.
+Added: Our CISO chairs the SQSG and decisions and recommendations are based on a consensus of the members.
+Added: Our CISO has over twenty years of professional experience, with thirteen years in information security roles.
+Added: He has been with Pega for over six years and has a Master of Science degree from Northwestern University.
+Added: Our Chief Product Officer has been with Pega for over thirty years, has extensive experience in software development, and has a Bachelor of Science from the Indiana University of Pennsylvania.
+Added: Our Vice President of Cloud Technology has been with Pega for over eight years and has twenty-six years of networking and security management experience, with eighteen years of leadership roles in cloud services and related information security issues.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.