Inside Pega Enterprise Infrastructure: Security and Encryption / Security Logs

Pega-as-a-Service
1

Continuing our series of posts on Enterprise Infrastructure capabilities, featured in a dedicated tab within the Blueprint dashboard, this post explores Security Logs.

Security Standards for Pega Cloud define comprehensive controls and compliance frameworks that protect your Pega Cloud environment, data, and operations against security threats.

:white_check_mark: What It means:

  • Pega Cloud Security Standards are a set of industry-recognized compliance certifications, security controls, and best practices that ensure your environment meets regulatory and enterprise security requirements.
  • Pega Cloud maintains including SOC 2 Type II, ISO 27001, and HIPAA compliance, ensuring continuous security monitoring and third-party audits.

:white_check_mark: What It Does

Enforces multiple layers of security protection:

  • Encryption at rest and in transit using TLS 1.2+ and AES-256 standards
  • Network isolation and firewall controls to prevent unauthorized access
  • Role-based access control (RBAC) and multi-factor authentication (MFA) for user accounts
  • Continuous security monitoring, threat detection, and incident response capabilities
  • Data backup, disaster recovery, and business continuity safeguards

:white_check_mark: How It Works

  • Pega Cloud implements a Defense-in-Depth strategy:
  • Perimeter security: DDoS protection, Web Application Firewall (WAF), and intrusion detection
  • Infrastructure security: Encrypted databases, secure APIs, and containerized workloads
  • Application security: Regular vulnerability scanning, penetration testing, and code reviews
  • Compliance audits: Third-party assessments validate adherence to SOC 2, ISO, and HIPAA standards on an annual basis

:white_check_mark: Best Practices

  • Enable multi-factor authentication (MFA) for all user accounts
  • Configure IP Allow Lists to restrict inbound traffic to trusted networks
  • Regularly audit access logs and monitor for suspicious activities
  • Follow the principle of least privilege when assigning roles and permissions
  • Keep security patches and updates current by coordinating with Pega Cloud maintenance windows
  • Review compliance certifications quarterly and maintain documentation for audit purposes

:open_book: Technical Documentation: Security standards for Pega Cloud