ServiceMax Trust Center

ServiceMax employs asset and data classification guidelines to ensure your security needs and priorities receive the right level of protection. ServiceMax protects your data by maintaining strict isolation between production and development environments. Depending on the product being consumed, some level of control may be passed along to you given the cloud security shared responsibility model. Security policies at multiple layers are applied to limit access to ServiceMax workforce members who possess a legitimate business need for such access. Additionally, data is de-identified where needed and transmitted in encrypted form using transport layer security (TLS). Encryption keys are then protected.

At ServiceMax, product security is fundamentally about protecting the applications and services that we build, along with the supporting platform and ecosystem that stores and processes your sensitive data. The concept of “Secure by Design” is ingrained in our engineering practices. Our secure development lifecycle (SDL) framework serves during the development process to secure applications and services. 

Following SDL empowers our engineering teams to:

1. apply the appropriate architecture and design
2. understand threats and choose the right controls for protection
3. conduct proper security testing
4. remediate vulnerabilities before production deployment

ServiceMax employs industry-leading technical controls at the infrastructure and platform layers to ensure threat mitigation capabilities meet stringent requirements and are highly effective. ServiceMax understands that isolating environments is key to reducing blast radius and, therefore, risk to customers. We leverage virtualization technologies at specific layers to ensure that application runtimes are separated from the operational and control elements in the network. This separation allows the user and application interactions to be monitored from the specific application instance and user, in and out of the internet, and through all the services. ServiceMax regularly audits its network security posture and specific technologies to verify they are compliant with policies and technical standards and has implemented penetration testing procedures to further validate effectiveness of the applied controls.

At ServiceMax, we believe security starts with establishing identities of things for objects of interest—including people, devices, applications, and data—defining relationships for those objects and enforcing appropriate controls for how these identities access resources. ServiceMax applies this mindset to how we build our products, secure data, and manage customers. ServiceMax, therefore, supports sophisticated mechanisms to prove identities, create roles across the ecosystem, and effectively authenticate and authorize access, while privileged accounts are further contained and managed.

Reliable encryption ensures that data is secure at rest and in transit. ServiceMax encrypts at different layers based on the product, to ensure that data is exposed on a need-to-know basis. ServiceMax supports key management systems, and public and private key infrastructures to effectively protect and manage keys and certificates. Application and service accounts are vaulted to further protect them from illegitimate access.

End user devices are protected by several layers of controls to ensure that the work that is conducted via these devices is done so in a safe and secure fashion. Controls, such as endpoint threat detection, mitigation and response, malicious website protection, and proper patching, are maintained so that the end user has a safe experience. Similarly, cloud endpoints that support ServiceMax products are built using secure configurations, undergo effective vulnerability management, and protected via cloud endpoint threat detection, mitigation, and response tools.

ServiceMax continuously monitors its environment for anomalies and suspicious events that may require incident response. ServiceMax’s Incident Response Program, includes on-going training, tabletop exercises, pen testing, vulnerability management, and threat intelligence, which come together to ensure the program has all the required touchpoints in order to address a potential incident and recover quickly. ServiceMax incident responders handle end-to-end coordination with stakeholders for swift deterministic notification, investigation, forensics, and closeout.

At ServiceMax, the Vulnerability Management Program exceeds industry standards with a disciplined and pragmatic approach. The program identifies vulnerabilities that may affect the platform and performs rapid remediation and mitigation to reduce other exposure to such vulnerabilities. The program maintains a network of recognized security researchers dedicated to continually evaluating the platform for vulnerabilities and identifying potential threats. The integration between the cyber research team and vulnerability management functions enables the rapid and focused remediation of critical issues to ensure that the platform is secure.

The cornerstone of a successful cyber resilience program is stress testing the environment to identify weaknesses and address them quickly. ServiceMax products and services undergo ongoing penetration testing to identify areas where business risk may exist. Considering attack vectors, a highly specialized team of researchers and pen testers carry out test scenarios, and a process is put in place to address any findings quickly. This continuous level of assessment provides the validation required for ServiceMax to instill confidence in our customers that products and services are highly resilient to cyberattacks.

Beyond security, ServiceMax also considers business continuity (BC) and disaster recovery (DR) as critical elements of its business operations. Much like data breaches and other security incidents, adverse events ranging from technical issues and natural disasters to mechanical failure or human error can disrupt customers and their ability to continue with their digital transformation journey. As a result, ServiceMax has a proactive BC/DR strategy that will ensure its product and services stay up and running in the event that certain elements are unavailable for any length of time. The associated processes and procedures supporting BC/DR are tested regularly in order to ensure their effectiveness. There are three main elements to the ServiceMax BCP/DRP: conducting an asset business impact analysis, a recovery strategy, and plan considerations. Leveraging industry-standard procedures, ServiceMax ensures that its BCP/DRP can successfully support one of its core imperatives—cyber resiliency.