Study guide
8.4 The Security Checklist & Secure Deployment
Pegasystems Certified Pega System Architect CSA
Track your progress as you read
Finished sections get a check mark.
1 Chapter 1: Exam Overview & Architecture Foundations
1.1 Certified Pega System Architect Exam Format, Blueprint & Strategy 1.2 Pega Architecture & Enterprise Class Structure (ECS) 1.3 Studio Environments: App Studio, Dev Studio, Admin Studio & Prediction Studio
2 Chapter 2: Case Lifecycle Design & Core Workflows
2.1 Case Types, Stages, Processes, and Steps 2.2 Routing Strategies: Worklists, Work Queues, and Teams 2.3 Service Level Agreements (SLAs) & Urgency Calculations
3 Chapter 3: Advanced Case Management Patterns
3.1 Multi-Step Processes, Parallel Processing & Sub-processes 3.2 Child Cases, Data Propagation & Wait Steps 3.3 Optional Actions, Approvals & Case Resolution 3.4 Duplicate Case Detection, Automation Shapes & Automated Correspondence
4 Chapter 4: Data Modeling & Data Page Architecture
4.1 Data Objects, Property Modes & Page Types 4.2 Data Pages: Scope, Types & Refresh Policies 4.3 Data Transforms & Object Mapping
5 Chapter 5: Business Logic, Calculations & Decisioning
5.1 Declare Expressions & Declarative Network Chaining 5.2 Decision Tables & Decision Trees 5.3 Integration Connectors, Systems of Record & Error Handling
6 Chapter 6: User Interface & User Experience Design
6.1 Traditional UI vs Constellation Architecture 6.2 Views, Dynamic Layouts, Design Templates & Action Sets 6.3 Form Validation, Edit Validate & WCAG Accessibility 6.4 Form Views: Default vs Hierarchical Forms, Field Groups & Primary Fields
7 Chapter 7: Rule Architecture & Rule Resolution
7.1 Rulesets, Versioning & Ruleset Stack Hierarchy 7.2 The Rule Resolution Algorithm 7.3 Circumstancing & Rule Specialization
8 Chapter 8: Security & Access Control
8.1 Authentication, Operator Records & Access Groups 8.2 Role-Based Access Control: Access Roles, ARO & Privileges 8.3 Attribute-Based Access Control (ABAC), Encryption & Audit Trails 8.4 The Security Checklist & Secure Deployment
9 Chapter 9: DevOps, Testing & Application Quality
9.1 Guardrail Compliance, Best Practices & Performance Profiling 9.2 Automated Testing: Pega Unit Test Cases & Scenario Testing 9.3 Packaging, Branching & Deployment Manager CI/CD
10 Chapter 10: Reporting & Operational Analytics
10.1 Report Definitions: Querying, Columns, Summaries & Joins 10.2 Filtering, Parameters & Column Exposure Optimization 10.3 Insights, Visual Dashboards & Business Metrics
11 Chapter 11: Mobility, Digital Channels & Portals
11.1 Mobile Channel Configuration & Offline Processing 11.2 Web Mashup, Digital Channels & Constellation Embed 11.3 Channels, Personas, Portals & Landing Pages
12 Chapter 12: Center-out Architecture, Enterprise Reuse & Agile Delivery
12.1 Center-out Business Architecture & the Case for Pega 12.2 The Situational Layer Cake, Modules & Enterprise Reuse 12.3 Agile Workbench, Workspaces, Branches, Delivery Roles & the Estimator
13 Chapter 13: Pega GenAI for System Architects
13.1 Pega Blueprint: Creating, Importing & Modifying an Application Design 13.2 Pega GenAI Autopilot & Pega GenAI Coach 13.3 Pega GenAI Connect Rules, Knowledge Buddy, Agents & Tool Rules
8.4 The Security Checklist & Secure Deployment
Key Takeaways Explain This Topic AI
The Security Checklist is Pega's built-in set of best practices for deploying an application securely, and completing it is a prerequisite for moving an application to production.
Checklist tasks are sequenced by phase: some belong at project initiation, some are performed continuously during development, and some are performed immediately before deployment.
Core checklist tasks include not deploying checked-out rules, removing unnecessary roles and operators from production, securing passwords, and setting production-appropriate application and system settings.
The checklist also covers web-tier protections: cross-site request forgery settings, Content Security Policies, CORS policies for REST services, and appropriate logging levels.
Security policies such as password composition, lockout, and session controls are configured at the system level and complement, rather than replace, the per-application checklist.
Last updated: September 2026
8.4 The Security Checklist & Secure Deployment
Sections 8.1 through 8.3 covered who can do what — authentication, access groups, roles, access of role to object, privileges, and attribute-based access control. This section covers the complementary discipline the blueprint names separately: the Security Checklist , Pega's structured set of tasks for taking an application to production safely.
1. What the Security Checklist Is
The Security Checklist offers Pega best practices for the secure deployment of applications. It exists to safeguard the confidentiality, integrity, and availability of an application once it is in production.
Two properties make it exam-relevant:
It is built into the platform, not a document someone writes. The checklist is part of the application record, so progress is tracked per application and is visible during reviews.
It gates deployment. Failure to complete the application Security Checklist blocks the application's deployment. Security is not a post-launch cleanup task on a Pega program.
The benefit statement the exam wants is straightforward: by following the checklist you address security concerns at the outset , stay vigilant throughout development , and avoid expensive rework late in the project, when insecure defaults are far more costly to unwind.
2. Timing: Three Classes of Task
The checklist tells you when each task should be performed, and that sequencing is itself testable.
Phase Nature of the work Representative tasks
At or near project initiation Decisions that are cheap now and expensive later Define and map authentication services to the application; decide the authorization model; plan audit requirements
Ongoing throughout development Habits that prevent debt from accumulating Keep rule check-outs disciplined; review access groups and roles as they are added; keep logging levels sane
Immediately before deployment Environment hardening Remove unnecessary operators and roles from production; secure passwords; configure production application and system settings; verify no checked-out rules ship
A scenario that says "the team plans to review all security configuration in the week before go-live" is describing an anti-pattern. The checklist is deliberately front-loaded and continuous.
3. Core Checklist Tasks
The checklist spans monitoring, authentication, authorization, auditing, and production testing. The tasks that recur in CSA scenarios are:
Do not deploy checked-out rules. A checked-out rule in production means the running application may execute a private, unreviewed version of a rule. Rules must be checked in before the product package is built.
Block unnecessary roles and operators from production. Development-only operators, sample data operators, and broad administrative roles must not survive into production.
Secure passwords. Replace default credentials, apply password policies, and confirm no passwords are stored in plain text in dynamic system settings or connector configurations.
Configure application settings and system settings for production. Environment-specific values belong in dynamic system settings and application settings so that the same rules behave correctly in each environment without editing rules.
Configure cross-site request forgery (CSRF) settings. Prevents an authenticated user's browser from being tricked into submitting unintended requests.
Define appropriate Content Security Policies. Restricts which script, style, and frame sources the browser will honor for the application.
Define appropriate Cross-Origin Resource Sharing (CORS) policies for REST services. Controls which external origins may call the application's services — essential when a Constellation front end or a mashup is hosted on a different domain.
Configure logging levels appropriately. Verbose debug logging in production leaks data and degrades performance.
Define and map authentication services to the application. Connects the application to the enterprise identity provider rather than leaving it on basic platform authentication.
4. Security Policies vs the Security Checklist
Candidates frequently conflate these. They operate at different levels.
- Security policies Security Checklist
- Scope System-wide authentication behavior Per-application deployment readiness
Examples Password composition rules, lockout after failed attempts, session timeout, CAPTCHA settings Remove dev operators, set CSP, verify no checked-out rules
Who owns it System administrator, usually in Dev Studio security landing pages The application's lead architect, tracked on the application record
Relationship Provides the enforcement mechanisms Confirms the mechanisms are actually configured for this application before release
Both are required. Strong password policies on a system that still ships a development operator with broad access has not achieved a secure deployment.
5. Auditing and Tracking Data Changes
Secure deployment is also about knowing what happened after go-live. Pega supports field-level auditing , which records the old value, new value, operator, and timestamp whenever an audited property changes, and a history record for the case itself. The checklist's auditing tasks confirm that the properties the business and its regulators care about — monetary amounts, decisions, status changes, personal data — are actually configured for tracking before the application handles live data.
6. Exam Framing
Questions in this area rarely ask you to recite tasks. They describe a team about to deploy and ask what must happen first, or they describe a symptom — an external domain cannot call a REST service, a browser blocks an embedded script, a user's session never expires — and ask which checklist item addresses it. Map the symptom to the control: cross-origin call blocked → CORS policy ; embedded script blocked → Content Security Policy ; forged request from another site → CSRF settings ; session never expires → security policies .