Pegasystems Cloud Software

Service scope

Software add-on or extension: Yes, but can also be used as a standalone service
What software services is the service an extension to: Pega Live Data provides a data virtualization layer so you can quickly and easily define the data models required to build your applications and how they’re connected to any back-end systems. You can then access that data on-demand in your live application without re-configuring where the data is stored.
Cloud deployment model: Hybrid cloud
Service constraints: Pega Cloud can be deployed in the Amazon EU-Ireland / UK Region, or on their private cloud infrastructure. Within this geographic zone Pega Cloud environments are deployed into multiple availability zones. Environments also then have the following further resiliency services applied:
• Backups of all environments on an ongoing basis
• Synchronous multi-availability zone database replication and load balancing delivering an RPO of approximately 1 minute and RTO of approximately 4 minutes
Production environments are provided with a 99.95% availability SLA. For each customer Pega provides purpose-built infrastructure dedicated to that customer within a dedicated virtual private cloud.
System requirements: Responsible for any Platform and or Application configuration and data

The following are provided as part of the standard service:

Pega software licenses, Pega cloud systems and full Operations/Engineering.

A dedicated (single-tenant) virtual private cloud for each customer.

Networking and security services supporting integration with back office systems.

Optimized application servers and database environment for Pega.

Infrastructure patching and system maintenance.

Database management services.

Full active environment monitoring.

Network and systems access monitoring.

User support

Email or online ticketing support: Email or online ticketing
Support response times: Pega Cloud does not provide direct support to end users, but this can be provided as an integrated service through SiXworks Pega Cloud Support Service offering.
User can manage status and priority of support tickets: Yes
Online ticketing support accessibility: WCAG 2.1 A
Phone support: Yes
Phone support availability: 24 hours, 7 days a week
Web chat support: No
Onsite support: No
Support levels: Support to the Pega Cloud capability can be provided by SiXworks through its Pega Cloud Support Service Offering. An integrated approach incorporating the Pega Cloud Platform, services to design and implement Pega in the customer's environment, and provide ongoing, multi-level support, can be provided through a combination of this Cloud Software service and Sixworks' Pega Cloud Support Service offering. SiXworks will act as the single point of contact to deliver Pega benefits to customers.
Support available to third parties: Yes

Onboarding and offboarding

Getting started: The customer journey is defined and resourced through this offering and the SiXworks Pega Cloud Support Service. This will ensure that customers are ready to exploit the benefits of the Pega capability from the outset.
Service documentation: Yes
Documentation formats: HTML
End-of-contract data extraction: Clients have two options the first of which is to extract the data from Pega’s working database. Pega’s cloud offering utilises a standard relational database making this a relatively simply task.

The second approach is to never hold such data in Pega in the first place. Where a client requires this approach Pega will support the use of data separation techniques to allow the client to maintain their data in a data store of their choice.
End-of-contract process: Pega Cloud will support the customer in removing their applications and data. This process will be completed within 14 days of contract termination

Using the service

Web browser interface: Yes
Supported browsers: Microsoft Edge

Firefox

Chrome

Safari

Opera
Application to install: No
Designed for use on mobile devices: Yes
Differences between the mobile and desktop service: Our solutions automatically render to fit to the size of screen of the device that they are being used on. They are built requiring no additional modifications. Our apps are 8 x quicker to deploy on mobile than Java Enterprise built applications.
Service interface: Yes
User support accessibility: WCAG 2.1 AA or EN 301 549
Description of service interface: Details of the Pega Platform interface can be found at:
https://www.pega.com/accessibility.
Pega has been shown to comply with UK, government/public sector and wider international accessibility standards in a number of UK public sector organisations and many international ones, in the US (Watson Institute), Australia and on continental Europe. Pega offers flexible application configuration so that the accessibility standards that a client chooses are really simply design and configuration decisions within the product. In this way Pega is successfully able to work within the accessibility requirements of most organisations, whatever they may be.
Accessibility standards: WCAG 2.1 AA or EN 301 549
Accessibility testing: Extensive work has been performed with the Watson Institute in the USA to ensure the user interface can comply with the needs of the disabled.
API: Yes
What users can and can't do using the API: The Pega API allows users to trigger the execution of Pega rules from 3rd party applications and systems. Every capability of the Pega application platform is contained within rules and so clients have access to any capability that they have configured within their rule sets. In addition to an API, Pega rules can also be exposed as web services if a client finds that more convenient. In either case business login and functions contained within rules of all different types can be called from external 3rd party applications.
Optionally, Pega Constellation allows views built within Pega to be embedded into 3rd party websites/applications with seamless styling and integration.
API documentation: Yes
API documentation formats: HTML
API sandbox or test environment: Yes
Customisation available: Yes
Description of customisation: Pega solutions, based on the Pega Platform and CRM, can be customised via our 'Directly Capture Objectives' (DCO) software feature. This allows business users and I.T. staff to customise the solution through a shared visual model that also automatically generates the documentation to accompany the changes.

DCO dramatically increases both the speed and accuracy with which applications are delivered and it also helps better engage with business in their enterprise projects.

DCO has two functions, one is to increase the speed of configuration and the second is empower users to collaborate with IT staff in the configuration of Pega based solutions. Technically nothing is out of bounds, with organisations able to make their own decisions about what users can and cannot customise.

It is a core premise that business processes can be modelled and refined by 3rd party users following a set of guardrails - from experienced developers through to citizen developers depending on the levels of customisation required.

Scaling

Independence of resources: In order to guarantee users aren't affected by demands of other users Pega Cloud is a single tenant environment. Additionally, when using Pega Cloud, services can be configured to auto-scale to meet your application demand, even beyond peak usage. Pega Cloud 3 scales dynamically, even if you have a sudden, unforeseen load increase.

Analytics

Service usage metrics: Yes
Metrics types: Pega includes a wealth of service metric reporting functions. The software includes a series of 'out of the box' reports and through Pega Report Creator customised reports can be built and deployed for individual or scheduled, repeated use. Reports can be viewed 'real time' via a browser or can be scheduled to be sent to individual or group e-mail addresses as PDF or excel attachments.
Reporting types: Real-time dashboards

Regular reports

Resellers

Supplier type: Reseller providing extra support
Organisation whose services are being resold: Pegasystems

Staff security

Staff security clearance: Conforms to BS7858:2019
Government security clearance: Up to Developed Vetting (DV)

Asset protection

Knowledge of data storage and processing locations: Yes
Data storage and processing locations: United Kingdom
User control over data storage and processing locations: Yes
Datacentre security standards: Managed by a third party
Penetration testing frequency: At least once a year
Penetration testing approach: Another external penetration testing organisation
Protecting data at rest: Physical access control, complying with SSAE-16 / ISAE 3402

Physical access control, complying with another standard

Encryption of all physical media

Other
Other data at rest protection approach: Physical access control, complying with CSA CCM v4.0
Data sanitisation process: No
Equipment disposal approach: A third-party destruction service

Data importing and exporting

Data export approach: Pega takes a completely open approach to data export allowing clients to utilise a variety of data export techniques ranging from file generation to formats such as Excel, delimited and pdf to REST and SOAP web service integration. Database integrations are also fully supported enabling clients to share data via JDBC connections and Pega’s BIX (Business Intelligence Exchange) data transfer capability. The fundamental point is that Pega will support a client in their data export needs using whatever technique the client would prefer.
Data export formats: CSV

ODF

Other
Other data export formats: PDF

Excel

Word

Tab

XML

JSON
Data import formats: CSV

ODF

Other
Other data import formats: XML

Excel

Tab

Data-in-transit protection

Data protection between buyer and supplier networks: Private network or public sector network

TLS (version 1.2 or above)

IPsec or TLS VPN gateway
Data protection within supplier network: TLS (version 1.2 or above)

IPsec or TLS VPN gateway

Availability and resilience

Guaranteed availability: Pega Cloud Production Subscriptions include a 99.95% availability SLA with 10% Service Credits available for failure to meet the SLA in a given month. Please refer to https://pdn.pega.com/pega-cloud-service-level-agreement/pega-cloud-service-level-agreement for further information.
Approach to resilience: Available on request
Outage reporting: The Pega Cloud Service Desk will communicate directly with any customers experiencing an outage via phone and E-Mail . Other methods can be made available through SiXworks Pega Cloud Support offering.

Identity and authentication

User authentication needed: Yes
User authentication: 2-factor authentication

Identity federation with existing provider (for example Google Apps)

Dedicated link (for example VPN)

Username or password
Access restrictions in management interfaces and support channels: Authentication and authorisation of users is the responsibility of the customer. Pega supports multiple external identity providers as well as SSO.
Access restriction testing frequency: At least once a year
Management access authentication: 2-factor authentication

Identity federation with existing provider (for example Google Apps)

Username or password

Other
Description of management access authentication: Authentication and authorisation of users is the responsibility of the customer. Pega supports multiple external identity providers as well as SSO

Audit information for users

Access to user activity audit information: Users have access to real-time audit information
How long user audit data is stored for: User-defined
Access to supplier activity audit information: Users have access to real-time audit information
How long supplier audit data is stored for: User-defined
How long system logs are stored for: At least 12 months

Standards and certifications

ISO/IEC 27001 certification: Yes
Who accredited the ISO/IEC 27001: Schellman & Company, an ANAB and UKAS accredited Certification Body.
ISO/IEC 27001 accreditation date: 25/1/2018
What the ISO/IEC 27001 doesn’t cover: N/A
ISO 28000:2007 certification: No
CSA STAR certification: Yes
CSA STAR accreditation date: 15/11/2022
CSA STAR certification level: Level 2: CSA STAR Attestation
What the CSA STAR doesn’t cover: N/A
PCI certification: No
Cyber essentials: Yes
Cyber essentials plus: Yes
Other security certifications: Yes
Any other security certifications: SOC 2 Type 2 report from an independent audit firm.

Pega Cloud meets the requirements of the HIPAA/HITECH regulations.

EU-U.S. and Swiss-U.S. Privacy Shield Frameworks

Pega Cloud for Government has achieved FedRAMP compliance

Meets accessibility requirements outlined by VPAT, Section 508 standards

Pega Cloud has been accredited for hosting on UK MODCloud

Security governance

Named board-level person responsible for service security: Yes
Security governance certified: Yes
Security governance standards: CSA CCM version 3.0

ISO/IEC 27001

Other
Other security governance standards: Pega Cloud has a Written Information Security Program (WISP) that is reviewed on at least an annual basis. The Pega Cloud WISP is designed to meet the requirements of NIST Special Publication 800-53, Revision 4. Pega is ISO/IEC 27001:2013 (“ISO 27001”) certified for information security management supporting infrastructure and services
Information security policies and processes: Pega Cloud has a Written Information Security Program (WISP) that is reviewed on at least an annual basis. The Pega Cloud WISP is designed to meet the requirements of NIST Special Publication 800-53, Revision 4. Pega is ISO/IEC 27001:2013 (“ISO 27001”) certified for information security management supporting infrastructure and services

Operational security

Configuration and change management standard: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Configuration and change management approach: Please refer to https://community.pega.com/knowledgebase/change-management-pega-cloud for details
Vulnerability management type: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Vulnerability management approach: Please refer to https://community.pega.com/knowledgebase/change-management-pega-cloud for details
Protective monitoring type: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Protective monitoring approach: Please refer to https://community.pega.com/knowledgebase/change-management-pega-cloud for details
Incident management type: Conforms to a recognised standard, for example, CSA CCM v3.0 or ISO/IEC 27035:2011 or SSAE-16 / ISAE 3402
Incident management approach: For the Pega Cloud itself, please refer to https://community.pega.com/knowledgebase/pega-cloud-incident-response-and-management for details. Incident management can be incorporated within customers' service management regime through SiXworks' Pega Cloud Support offering.

Secure development

Approach to secure software development best practice: Conforms to a recognised standard, but self-assessed

Public sector networks

Connection to public sector networks: Yes
Connected networks: Other
Other public sector networks: Pega is connected to elements of UK MOD's Cloud infrastructure

Social Value

Fighting climate change
Covid-19 recovery
Tackling economic inequality
Equal opportunity
Wellbeing

Fighting climate change

We ensure that our services are as energy efficient as possible, for instance by acquiring battery banks in preference to internal combustion engine powered back-up. Wherever possible we exploit public cloud and the existing Green initiatives in place through the company providing our rented facilities. Our services allow for the maximum uptake of secure, remote working, reducing travel costs and impact.

Covid-19 recovery

Services support home working and provide opportunities for home and remote working on sensitive data. Sixworks and its customers were able to continue full productivity during lockdown. Sixworks provided employment opportunities for experienced professionals and more junior, graduates and non-graduates in the IT sector. We proactively support physical and mental health through encouraging activity and organising social events.

Tackling economic inequality

Sixworks is a young, energetic and innovative company with a strong, entrepreneurial spirit. We have an equal opportunities approach to employment. As signatories to the Armed Forces Covenant and award holders on its Employer Recognition Scheme we explicitly support ex service personnel, service families and those in the Reserve Forces. We provide training and development opportunities free of charge to employees. We are ourselves a SME, and look to other SMEs to join our supply chain. We specialise in Cyber Security and the identification of Supply Chain cyber risks.

Equal opportunity

We support disabled people in developing new skills, as well as providing a physically accessible environment. We provide in-work progression to all, including any from disadvantaged or minority groups. As signatories to the Armed Forces Covenant and award holders on its Employer Recognition Scheme we explicitly support ex service personnel, service families and those in the Reserve Forces

Wellbeing

We proactively and openly support physical and mental health through encouraging activity and organising social events, as well as through our supportive system of line management and welfare provision. We proactively address mental health.

Pricing

Price: £500 to £1,986 a unit a day
Discount for educational organisations: No
Free trial available: No

Features

Benefits

Service documents

Framework

Service ID

Contact

Service scope

User support

Onboarding and offboarding

Using the service

Scaling

Analytics

Resellers

Staff security

Asset protection

Data importing and exporting

Data-in-transit protection

Availability and resilience

Identity and authentication

Audit information for users

Standards and certifications

Security governance

Operational security

Secure development

Public sector networks

Pricing

Service documents

Cookies on Digital Marketplace

Pegasystems Cloud Software

Features

Benefits

Pricing

Service documents

Framework

Service ID

Contact

Service scope

User support

Onboarding and offboarding

Using the service

Scaling

Analytics

Resellers

Staff security

Asset protection

Data importing and exporting

Data-in-transit protection

Availability and resilience

Identity and authentication

Audit information for users

Standards and certifications

Security governance

Operational security

Secure development

Public sector networks

Social Value

Pricing

Service documents