Maintain Business Continuity

With the Five9 Intelligent Cloud

Contact Center

This white paper is designed to help you evaluate how the

Five9 Intelligent Cloud Contact Center can help maintain
and fit into your current or developing business continuity
plan. After reading this, you will have an understanding
of how Five9 delivers the most trusted and reliable cloud
contact center in the industry.

1
 Table of Contents

Business Continuity. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
Reliability, Availability, and Uptime. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
Five9 Trust Site . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4

Modern Cloud-Based Business Continuity Architecture. . . . . . . . . . . . . . . . . . . . . . . . . 5

Redundancy. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

Geographic Redundancy. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

Carrier Redundancy. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

Global Engagement Center. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

Voice Redundancy and Quality Control. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

Fault-Tolerant Hardware Architecture. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

Five9 Global Voice. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

Five9 Voice PoPs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

Modern SaaS Architecture. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

Modern SaaS Approach . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

Multi-Tenanted . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

Public Cloud. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

Infrastructure as a Service (IaaS). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

Platform as a Service (PaaS). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

Service Mesh. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

Containers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

Decomposition and Microservices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

Digital Transformation Requires Data. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

APIs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

Continuous Integration and Delivery – Launch Darkly. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

Network Operations – Dedicated to Uptime . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

IP Network . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Infrastructure. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

Reliability. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

Dependability. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

Security. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

Scalability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

Five9 White Paper: Maintain Business Continuity With the Five9 Intelligent Cloud Contact Center 2
 Data Protection. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Administrative, Physical, and Technical Safeguards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

Defense-in-Depth Approach. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

Five9 Information Security Staff. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

Continuous Improvement. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

Security and Privacy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

SOC 2 Type 2 Attestation in Accordance with AICPA Standard AT 101. . . . . . . . . . . . . . . . . 13

General Data Protection Regulation (GDPR). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

Payment Card Industry Data Security Standard (PCI DSS). . . . . . . . . . . . . . . . . . . . . . . . . . . 13

Customer Proprietary Network Information (CPNI). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

Health Insurance Portability and Accountability Act (HIPAA). . . . . . . . . . . . . . . . . . . . . . . . 14

Protected Health Information (PHI). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

Environmental Changes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

Conclusion. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16

Five9 White Paper: Maintain Business Continuity With the Five9 Intelligent Cloud Contact Center 3
 Introduction
Your contact center is critical to your business and your ability to provide the exceptional
service and support your customers need and expect. When business is disrupted –
whether from a natural disaster or any other unplanned event – you must be able to
quickly adapt and maintain contact center operations.
Any downtime directly impacts your bottom line and, more importantly, affects your
customers’ ability to connect with you. When your customers are depending on you for
support, you can depend on the Five9 cloud to reliably ensure business continuity during
any disruption.

Any amount of downtime damages your bottom

line and impacts your ability to deliver exceptional
customer service.

Reliability, Availability, and Uptime

The discussion regarding reliability for cloud vendors has coalesced around uptime being
comparable or greater than that of on premises software. The ultimate goal is 99.999%
uptime. This equates to about five minutes of downtime over the course of a year. Many on
premises systems struggle to reliably maintain even 99.9% uptime, which equates to about
eight hours of downtime over the course of a year.
Any amount of downtime damages your bottom line and impacts your ability to deliver
exceptional customer service. Situations change quickly, and time is not always on your
side. Whether it’s a fire, flood, snowstorm, or any other situation out of your control, you
need a reliable technology partner to prevent disruption and keep your contact center
online. Five9 provides a number of capabilities that meet the reliability, scalability,
security, and quality requirements to ensure business continuity during natural disasters
or other unforeseen events that can disrupt operations.

Five9 Trust Site

Five9 Trust site, launched in October 2015, publishes the last twelve months of reliability
for the Five9 service – providing the visibility customers and prospects expect. Reliability,
availability, and uptime are a top priority for Five9 and providing that transparency is a
proof point for the reliability of our service.
Within the trust site, you can view average monthly system availability, Five9 security and
privacy information, security best practices, and voice and data network details.
Users with Five9 login credentials can access the system status page that displays when
any active incidents are affecting the platform. Customers can submit service tickets
through this self-service portal and receive updates electronically.

Five9 White Paper: Maintain Business Continuity With the Five9 Intelligent Cloud Contact Center 4
 Modern Cloud-Based Business Continuity Architecture
Redundancy
There is no single point of failure with the Five9 Intelligent Cloud Contact Center.
The Five9 application is hosted in hardened, carrier-grade, co-location facilities.
Each Five9 data center is designed with multiple tiers of redundant servers. The
database servers, messaging servers, application servers, and web servers are
implemented in clustered configurations. All hardware has redundant physical
connections such as network cards and power supplies. Telco carriers are
diversified, such that if one carrier fails, the trunks are easily rerouted so that
calls are perpetually completed. Five9 also utilizes redundant ISP services from
Verizon and Internap.

Geographic Redundancy
Five9 provides capabilities that help you ensure business continuity during natural
disasters or other unforeseen events that can potentially disrupt operations.
You can opt for geographic redundancy, ensuring that your operations transition
between our geographically distributed data center within minutes after an event.
Five9 also backs up your data to another facility to prevent data loss in the event
of a natural disaster at a primary data center.
The Five9 U.S. data centers are located within the CoreSite facility in Santa
Clara, California and within the QTS facility in Atlanta, Georgia. The European
data centers are located within Equinix facilities in Slough, United Kingdom, and
Amsterdam, Netherlands. In addition to being fault tolerant within each data
center, data centers are designed to be able to pick up the traffic of their pair
in the event of an outage. Customers can run primary in either of the paired
data centers and utilize the other paired site as a failover location. The same
infrastructure exists in each of the paired sites with two-way replication for
seamless failover capability.

North American and European geographic redundancy

Carrier Redundancy
Five9 offers a robust voice services offering that includes redundancy with
three carriers for 1-800 service, four for DID, eighteen carriers for domestic long
distance, and ten carriers for international, including inbound and outbound.
Five9 is a toll-free RespOrg and offers 1-8XX, international toll-free, and domestic
and international DID services.

Five9 White Paper: Maintain Business Continuity With the Five9 Intelligent Cloud Contact Center 5
 Long distance partners include AT&T, Verizon, Level 3, BT, Telefonica, Windstream,
Peerless, Intelepeer, Novatel, Iristel, Voxbone, Colt, XO, Orbitel, Apeiron, and Impact
Telecom. Five9 uses primarily VoIP using SIP protocol, but also offers TDM to meet
certain requirements as needed.
Most customers choose to have Five9 handle all telecom services, domestically and
internationally, but we accommodate requests to utilize your own telephony services.
This is done via SIP trunks either to your PBX or to your chosen telecom carrier.
This environment of carriers allows for distribution of calls to carriers such that if
one or many carriers are having network impairments, calls are routed to other, non-
impacted providers offering the best quality calling platform in the industry.

Carrier Redundancy
Domestic/
Carriers In/Out International

AT&T In Domestic

Level 3 Both Both

Neustar LNP Element Business Customer Rate Verizon Both Both

Database Manager Rules Info Sheets
CenturyLink In Domestic

BT Out International

Peerless Out Both

TNCI Out Domestic

Magna5 Both Domestic

Routing Quality Windstream Out Domestic
Policy MCR Monitoring
Intelepeer Out Domestic

Orbitel Out Both

Apeiron Out Domestic

SBC Iristel Out International

Telefonica Out Both

Agent SBC Five9 VCC
Bluestone Out Domestic

Colt Out I
B-Side A-Side
Voxbone Both Both

Avoxi In I

Carriers PSTN

Global Engagement Center

Voice Redundancy and Quality Control
The Five9 telephony layer utilizes a best-of-breed telephony switching, routing,
and security platform known as a session border controller (SBC) for voice over IP
calling traffic. In addition, we have a multiple interexchange carrier-routing protocol
that utilizes over a dozen Tier 1 domestic and global telephony providers to route
telephone calls to destinations all over the world.
Five9 deploys Sonus SBCs with a global routing database in all U.S. locations and
European data centers. SBCs are capable of handling all SIP and RTP sessions and
perform transcoding and other media handling functions in addition to serving a
security purpose.
The feature set offers a high level of fault tolerance for outbound and inbound call
traffic, providing you with a dynamic layer of protection from any single carrier failure.
Five9 utilizes performance metrics like post dial delay, answer-seizure ratio, jitter, packet
loss, latency mean opinion score, and R-factor to rank the quality of each carrier.
All media is anchored in the Five9 platform where audio can be mixed and calls can
be enhanced.

Five9 White Paper: Maintain Business Continuity With the Five9 Intelligent Cloud Contact Center 6
 Fault-Tolerant Hardware Architecture
The Five9 architecture is designed with fault-tolerant principles in the early stages of
the Five9 development lifecycle, through deployment, and into maintenance phases.
Five9 deploys and operates technology in paired data centers without reliance on any one
location. The network and telecommunications capabilities are consistent across locations
with the ability to move traffic between the paired sites seamlessly. Five9 implements
fault tolerant telecom edge with many carriers for route redundancy, as well as multiple
network providers with diverse paths in each location.
The switching and routing platforms have a high-availability topology with full
redundancy capabilities within the same geographic location, as well as automatic
failover to devices in other Five9 data centers in other geographic locations, making
the platform highly available and geographically diverse.

Five9 Global Voice

Five9 realizes that to have a great conversation you need great voice quality. That’s why
we have enhanced Five9 Global Voice, a global infrastructure offering that enables Five9
customers to create a global engagement center using Five9 cloud-based contact center
technology. Five9 Global Voice supports multiple geographic regions minimizing capital
expenses for property, energy, IT, and services. Five9 Global Voice is designed to deliver
unparalleled voice quality leveraging regional Five9 voice points of presence (PoPs) to
connect customers and agents with low-latency, rich, quality audio. Your customers will
think you are in the next room while, in reality, agents are located all around the globe.
Five9 Global Voice makes it easier and more desirable for you to expand your contact
center infrastructure globally. With international carrier-grade voice with over thirty
carriers, Five9 Global Voice improves voice quality in global locations by leveraging public
cloud servers to terminate voice close to the agent. This eliminates poor audio connection
due to voice gaps, delay, or jitter.
When paired with the Five9 Intelligent Cloud Contact Center routing capabilities, it gives
enterprises the ability to create “follow the sun” routing strategies that look for the best
possible agent for that specific customer or prospect interaction.

We leverage Amazon Web

Services and Google Cloud
Platform to build in region
voice PoPs. Therefore, we
are able to take advantage
of existing infrastructure to
deliver enhanced reliability Canada Data Center EMEA Data Centers
Montreal, Canada Slough, UK
through the use of multiple Amsterdam, NL
US Data Centers Direct Connection ASIAPAC FVP
availability zones/regions
Santa Clara, CA Beijing 1, CHN Five9 Voice PoPs
when deploying our Global Atlanta, GA Beijing 3, CHN Tokyo, JPN
Sydney, AUS
Low-Latency Path
Five9 Data Centers
Optimized Internet
S.Korea
Five9 Public Taiwan
Cloud Data Center São Paulo Hong Kong
Five9 Voice PoP
São Paulo, Brazil
Five9 Direct Connectivity
China LATAM

Five9 Voice PoPs

To ensure the highest quality voice, Five9 has localized voice PoPs strategically all around
the world to ensure customers and agents are close enough that there is no perceived
delay in the voice communication. A voice PoP is a way to leverage the global network
infrastructure to provide local, latency-free, redundant, high-quality, HD voice from any
location to any location in the world.

Five9 White Paper: Maintain Business Continuity With the Five9 Intelligent Cloud Contact Center 7
 Localizing voice PoPs in carefully selected locations allows for best voice quality between
agents and callers in the same region. It allows you to easily and rapidly scale your agent
coverage across the globe based on your unique business needs. Time sensitive resources
such as announcements, text-to-speech, voice prompts, voice recording, answering
machine detection, and speech recognition can all be located locally.
Meanwhile, unified management and reporting can be controlled under a single domain
supporting thousands of concurrent calls. Now you can focus on agent training, resource
costs, agent location, and all of the other elements that go into building a great customer
service operation that provides a more human customer service experience.

Modern SaaS Architecture

Modern SaaS Approach
The use of modern software as a service (SaaS) architecture has become increasingly
popular for software companies and for good reason. Older technology deployment
methodologies have serious limitations. However, not all SaaS providers are necessarily
keeping up with the latest innovations. This section provides an overview of some of the
newest capabilities that are helping Five9 deliver results for your business.

Multi-Tenanted
A multi-tenanted cloud approach makes provisioning new customers or new agents
radically easier compared to the old on premises experience or the slightly newer single
instance “cloud hybrid” architectures. With traditional on premises infrastructures,
dedicated hosted, and multi-instance architectures, a new environment is setup for
each business. This results in higher costs but, more critically, it hampers ongoing
transformation of the business by increasing the
cost and time for ongoing maintenance.
Single tenant cloud is similar to on premises technology and acts as an intermediary state
for SaaS. Vendors taking this approach use the same on premises software and host it
for you remotely for a fee. Servers are still unique to you using hardware and instances
that are maintained for your business, but you are paying someone else to maintain it for
you. As an explanation, if on premises software was a car you purchased and maintained
yourself, a cloud hybrid or single tenant cloud solution is the car you purchased and paid
someone else to maintain for you. The code is largely the same and scaling is largely the
same, but you are paying someone else to do the work.

Five9 White Paper: Maintain Business Continuity With the Five9 Intelligent Cloud Contact Center 8
 Multi-tenanted contact center as a service (CCaaS)/SaaS providers are different. They
have the same instance of software for their entire customer base which focuses their
efforts on keeping that single code base free of defects. All innovation pours into that
code base as well so that companies can take advantage of innovation faster, without
big projects to move to the latest code. Think of it as a system of bullet trains selling you a
ticket for space on the train. The capacity is already there. Multi-tenant SaaS is the more
modern approach to cloud, and along with Five9 it is the approach used by all the major
cloud players such as Salesforce, Zoom, Google, and Amazon.
Contact center software is the core of our service. As a company born in the cloud, it is
important that we continue to leverage Google Cloud Platform (GCP) and Amazon Web
Services (AWS) for the latest techniques and infrastructure to achieve modern agility,
scalability, and safety. The deep roots of Five9 in the contact center industry has allowed
us to leverage our core services while adding the scalability of modern SaaS.

As a company born in the cloud, it is important that

we continue to leverage Google Cloud Platform
(GCP) and Amazon Web Services (AWS) for the latest
techniques and infrastructure to achieve modern
agility, scalability, and safety.

Public Cloud
For some time, foundational elements of SaaS have been advancing. Broadly speaking,
these can be broken down into three elements that continue to expand as demand for
the capabilities grows based on increased usage.

Infrastructure as a Service (IaaS)

This capability provides hardware as a service. It started with computing power based
on physical devices that companies can rent. It entered the mainstream around 2012 and
has continued to grow in usage ever since. Infrastructure as a service includes essential
components such as hosted computing power, networking, and data storage.

Platform as a Service (PaaS)

Platform as a service is considerably more recent. Real usage of these kinds of capabilities
beyond the early adopter phase started around 2018. Broadly, PaaS provides higher level
components like storage, data busses, eventing, or logging on top of the base computing
power provided by IaaS.

Service Mesh
Service mesh is the loose term that is being used to describe the next wave of capabilities
helping to normalize code development. It is working to remove the effort related to
security, provisioning, connectivity, observation, and control from the developer so that
the developer can focus on the solution and not on the environment.

Containers
Containers (an example is Docker) are self-contained and runnable, designed to make
it significantly easier to rollout and rollback code changes. For new product releases or
enhancements, Five9 deploys code in containers, which isolates applications from one
another and the underlying infrastructure. This makes it easier to trial software with our
customers. If necessary, Five9 can rollback code very quickly with the container model
but, more importantly, helps enable Five9 to test and deliver code more rapidly and safely.

Five9 White Paper: Maintain Business Continuity With the Five9 Intelligent Cloud Contact Center 9
 Decomposition and Microservices
Mistakes happen. They’re part of human nature and the world that we live in. The key is
to recover quickly from negative occurrences when they happen and minimize the real-
world impact. Decomposition and microservices can help isolate code by building smaller
functional units helping to minimize the impact of mistakes or downtime.
Five9 began working with microservices in 2015 by creating microservices for the customer
service media channels including chat, email, voice, and social. Since then we have moved
languages and integration elements into microservices. New capabilities such as Five9
Global Voice and the Five9 voice services softswitch were built based on microservices.
Today we continue to use decomposition and microservices to build a resilient, scalable
service. This also has positive benefits on scale as the specific code functions can be
brought up or down dynamically to meet demand.

Digital Transformation Requires Data

Data is the driving force when it comes to making decisions. Understanding productivity
of agents, analyzing customer interactions, and making the leap forward in digital
transformation can make all the difference for the success of your business. Iteration
is golden both for Five9 and our customers. Data is required to iterate with success and
it is much easier in SaaS environments to use data effectively. While it is possible with
on premises, it’s much more difficult. Environments are very fragile, and it takes a lot of
planning and work to stitch the various systems together. Data is considerably easier to
collect, store, and leverage when it’s in the cloud.
Recent innovations in speech to text have also unlocked voice data for rapid analysis.
Five9 has always stored voice in the cloud, but we now have the ability to turn that
voice into text and that opens up agent assistance, interactive voice agents, automated
compliance, and traceability for application text as well as real-time voice.

APIs
Modern SaaS wouldn’t be so modern without APIs. They make it easier for Five9 to develop
and deploy APIs, and they make it easy for our customers as well. The ability to interact
and test with our application gives you a sense of what is possible when using Five9. Users
can see what works in an environment that provides a safer and easier way to innovate.

Continuous Integration and Delivery – Launch Darkly

In order for Five9 to continue providing best-of-breed contact center software, we turn to
our customers for real-world experiences. A more collaborative approach to the contact
center has been a recipe for success as we leverage our ability to make continuous
improvements and produce even greater results. Product innovation is the engine of
Five9 and leveraging modern SaaS technology provides the ability to meet your specific
business requirements and provide a more human customer service experience.
We make incremental improvements that help us meet our customers’ needs with lower
risk. Five9 uses feature flags to determine when new capabilities or experience changes
are exposed. Our customers have expressed that changes in the user experience,
especially to agents, require a pilot program, documentation, and training, as well as
the ability to control the timing for experience change rollout.
To address this need, Five9 has adopted Launch Darkly. Continuous integration and
continuous delivery are common techniques for accelerating innovation, but without
some advanced feature flagging it can be hard to adopt rapid agent experience changes.
This is new work that is underway and will allow Launch Darkly for enterprise feature
flagging. You can choose when you want to expose new functionality or user experiences
to your agents. When features become available, you have the choice to expose them to a
pilot set of supervisors, a specific team of second line support, or for a 24-hour period to
train your entire user base.
This allows for the free flow of innovation and puts control of agent experience and the
timing of change into your hands.

Five9 White Paper: Maintain Business Continuity With the Five9 Intelligent Cloud Contact Center 10
 Network Operations – Dedicated to Uptime
The telephony platform is monitored at all times by the always-on Five9 Network
Operations Center (NOC), which has locations in the U.S. and Eurasia and is staffed by
dedicated Five9 employees.

IP Network
The Five9 IP network infrastructure is built to support the most stringent requirements
in terms of robustness and security. Many of our customers must comply with data
protection laws, regulations, and industry standards in various jurisdictions throughout
the world. As such, the Five9 platform offers world-class security features and resiliency.
Five9 IP topology consists of redundant Layer 3 switches, routers, and firewalls, as well
as intrusion detection and protection systems used by many of the top security experts
worldwide. All hardware is redundant with load sharing front-end and back-end switches,
routers, and firewalls.
Additionally, all connections to the Internet are route diverse with Tier 1 providers.

Infrastructure
The Five9 IT infrastructure solution provides you with fast, reliable, and secure access
to your contact center applications. Five9 supports a variety of connectivity options
that enable you to leverage more commonly used connections – internet, point-to-point
dedicated connection, multi-protocol label switching (MPLS), virtual private network
(VPN), or agent connected managed solutions.

Reliability
At Five9, we’re committed to deliver extraordinary customer experiences by embracing
change and challenging the status quo by providing our customers with geographic
redundant data center solutions, top-tier redundant data circuits, and a host of top-tier
data providers and the ability to leverage a fully managed end-to-end solution.

Dependability
Five9 delivers high performance that you can count on. Our network infrastructure
evaluation and planning service offers a comprehensive network security assessment
including analysis, planning, design, testing, and implementation to help ensure your
business is optimized for success.

Security
Five9’s holistic approach to security ensures multiple layers of security are present
to detect and mitigate real or potential threats throughout the communication
system including:
• Web application and next-generation firewalls

• Intrusion prevention and detection systems

• Periodic internal and external vulnerability scanning

• Routine firmware updates and testing to mitigate vulnerabilities

Security and technology risk management experts at Five9 continuously assess the threat
levels of the Five9 infrastructure to maximize the level of security integrity offered to our
customers, providing the level of service they expect and deserve. Updates to underlying
software components are conducted as needed for identified security risks.

Scalability
Five9 developed its cloud-based contact center solution to be flexible both in terms of
easing the adoption of cloud technology by customers and with its capacity to easily
scale horizontally and vertically.

Five9 White Paper: Maintain Business Continuity With the Five9 Intelligent Cloud Contact Center 11
 First, our cloud-based solution makes it possible to work with your existing infrastructure
and investments that you may already have in place such as PBX and CRM systems.
Second, Five9 allows you to add features as needed. Typically, new features can be
added within 48 hours of the request. If customization is required, a project team will be
assembled and a statement of work will be drafted. As a cloud company, Five9 doesn’t
require an upgrade or change of hardware to enable new features. All domains are
capable of adding any feature offered.
Finally, Five9 offers quick, simple scalability in terms of capacity. There is no practical limit
to the number of agents supported on Five9. Most increases in telephony lines and seat
capacity can be accommodated within 24 hours. Agent license counts are determined in
advance of each month, according to your projections, which allows you to staff up/down
monthly or seasonally if desired. Agents can be multi-skilled and handle calls, emails, and
web chat simultaneously, depending on their skill and permission levels. During the sales
and deployment processes, we work closely with your team on the overall design as this
impacts the maximum number of concurrent calls.

Data Protection
At Five9, we understand data protection starts with us. Our executive management team
plays a key role in continuously assessing and monitoring cyber-security risks to the Five9
operating environment to ensure business continuity.

Administrative, Physical, and Technical Safeguards

Five9 has designed and implemented administrative, physical, and technical safeguards in
accordance with a number of data protection laws, regulations, and standards including,
but not limited to, the Health Insurance Portability and Accountability Act (HIPAA),
Payment Card Industry Data Security Standard (PCI DSS), General Data Protection
Regulation (GDPR), and the UK Data Protection Act 1998.
Administrative safeguards include an information security management process aligned
with ISO 27001/27002, full-time security personnel, processes for information access
management, workforce training and awareness, and ongoing evaluation of the control
environment. Physical safeguards include facility access controls and workstation/device
security measures. Technical safeguards include controls for role-based access, audit
logs, data integrity, and data transmission security.

Defense-in-Depth Approach
Five9 defense-in-depth strategy provides layers of security from the edge of the Five9
network to the core to mitigate the risk of unauthorized access or use of systems that
contain confidential customer or corporate data. Five9 has implemented “least privilege,
minimum-necessary” role-based access controls to restrict access privileges to systems
containing confidential customer or corporate data only to those employees whose roles
require it.
Five9 has also implemented the following to defend against cyber exposures:
• Stateful inspection firewalls

• Demilitarized zones (DMZs)

• Intrusion prevention and detection systems (IPS/IDS)

• Vulnerability scanning

• Annual penetration testing

• File integrity monitoring (FIM)

• Anti-virus/anti-malware protection

• Two-factor authentication

• Virtual private networking (VPN)

Five9 White Paper: Maintain Business Continuity With the Five9 Intelligent Cloud Contact Center 12
 Five9 Information Security Staff
Five9 Information Security staff performs continuous improvements to the Five9
environment and ensures Five9 has timely visibility into security and privacy risks, issues,
and incidents. Five9 staff is also accountable for:
• Monitoring intrusion prevention and detection systems

• Regularly performing information security assessments and vulnerability scans

• Taking appropriate actions to patch system vulnerabilities

• Promptly investigating and reporting security alerts and assessment findings to

executive management

• Escalating product enhancements and improvements to engineering based on

discovered vulnerabilities

Continuous Improvement
Five9 performs ongoing information security and privacy training administered to
all workforce members. This ensures a common understanding of applicable data
protection laws and regulations, as well as how to identify and report security risks to
executive management. This effort is designed to promote a culture of compliance and
reinforces the concepts of “Know it. Own it. Control it.” with respect to data protection
accountability at all levels of the company.

Five9 performs ongoing information security

and privacy training administered to all
workforce members.

Security and Privacy

SOC 2 Type 2 Attestation in Accordance with AICPA Standard AT 101
Five9 has completed a SOC 2 Type 2 audit in accordance with American Institute of
Certified Public Accountants (AICPA) Standard AT 101 and AICPA trust services principles
and criteria for security, availability, processing integrity, confidentiality, and privacy.
Our SOC 2 Type 2 attestation offers customers one of the highest forms of assurance
available in the marketplace today. Our report covers the AICPA Security Principle in
relation to Five9 Intelligent Cloud Contact Center and provides an independent and
objective opinion that Five9 has developed, implemented, operates, and maintains security
controls that customers expect for data protection and regulatory compliance purposes.

General Data Protection Regulation (GDPR)

Five9 continues to evolve and improve our Intelligent Cloud Contact Center service to
offer features required for our customers to comply with the GDPR regulation. Areas of
focus include information security, breach management, content management, data
visibility, individual data rights management, and records management.
Five9 requests our customers, otherwise known as the data controllers, to notify us
of their EU processing activities so we can maintain an accurate report of processing
activity as required by the GDPR.

Payment Card Industry Data Security Standard (PCI DSS)

As a Level 1 PCI DSS Service Provider, Five9 engages an independent Qualified Security
Auditor (QSA) to perform an annual assessment of Five9’s control environment covering
all 12 PCI DSS requirements for the design, implementation, and continuous improvement
of controls for safeguarding cardholder data and sensitive information.

Five9 White Paper: Maintain Business Continuity With the Five9 Intelligent Cloud Contact Center 13
 Five9 has received our annual Report on Compliance (ROC) and an associated Attestation
of Compliance (AOC). Customers who order the security features required to comply with
the PCI DSS standard including encryption of voice in transit (sRTP or VPN) and encryption
of call recordings at rest (encrypted storage) are provided a PCI compliant environment
for their contact center services.

Customer Proprietary Network Information (CPNI)

Five9 complies with Federal Communications Commission (FCC) regulations for
protecting the confidentiality of CPNI data including telephone numbers, times, dates,
and duration of calls, as well as the types of services and products we provide you. We
have designed and implemented security and privacy controls to protect CPNI from
unauthorized access or improper use. Five9 does not sell CPNI to third parties, and we
do not disclose CPNI without customer consent except as required by law.

Health Insurance Portability and Accountability Act (HIPAA)

Five9 has many customers in the healthcare sector including providers, hospitals,
insurance companies, and business process outsourcers. Five9 has designed and
implemented appropriate administrative, physical, and technical safeguards for
protected health information in transit and at rest in compliance with HIPAA. These
safeguards include, but are not limited to:
• Least-privilege, minimum necessary access controls

• Two-factor authentication for highly privileged users

• Encryption of data in transit between customers and VCC (requires sRTP or VPN option)

• Encryption of data at rest for call recordings (requires encrypted storage option)

• Rigorous change management processes

• Anti-virus and anti-malware defenses

• Intrusion detection and prevention systems

• Internal and external vulnerability scanning

• Periodic network penetration testing

• Secure code development lifecycle

• 24x7x365 network operations center

• SIEM monitoring and a 24x7x365 security operations center

• Problem and incident management processes

• Geographic redundancy for business continuity

• AICPA Service Organization Control (SOC) attestation reports

• Ongoing information security and privacy training and awareness

From operating systems to java environments,

Five9 uses a variety of technologies as the
foundation to build our service.

Five9 White Paper: Maintain Business Continuity With the Five9 Intelligent Cloud Contact Center 14
 Protected Health Information (PHI)
Five9 continues to grow and expand our relationships with the healthcare sector. Five9
has designed and implemented appropriate measures to comply with Protected Health
Information which includes health information in any form including records, electronic
records, or spoken information. Therefore, PHI includes health records, health histories, lab
test results, and medical bills. Essentially, all health information is considered PHI when it
includes individual identifiers.
Five9 text interaction transcripts (emails, chats, SMS, etc.) between a health care provider
and a member/patient that contains PHI, is encrypted at rest and HIPAA compliant.

Environmental Changes
From operating systems to java environments, Five9 uses a variety of technologies as the
foundation to build our service. When choosing technology, we are careful to balance
new features against security and stability concerns. To that end, we continue to update
a number of aspects of the underlying technology infrastructure to take advantage of
bug fixes, security enhancements, and reliability improvements. We make incremental
updates all the time with the service so that we can maintain a flexible platform for
feature enhancements as new technology breakthroughs change consumer buying
and communication habits. Some of the areas we focus on for security, flexibility for
enhancement, and stability include:
• Operating systems

• Browsers

• Java versions

• Third-party infrastructure products

• Shared cache

• Databases

• Best-of-breed Five9 contact center service elements

• Answering machine detection

• Text-to-speech and speech recognition

• Workforce optimization

We evaluate release changes annually for most third-party software elements. In

some cases, we provide ad hoc updates based on specific release cycles or identified
threats discovered.
Due to the dependence between the Five9 service and browsers, we have close relationships
with the leading browser providers. We are part of their release cycles, test the browsers
for compatibility during the beta phase, and release any required changes in conjunction
with the general availability of those new versions to the market wherever possible.

We evaluate release changes annually for most third-party

software elements. In some cases, we provide ad hoc updates
based on specific release cycles or identified threats discovered.

Five9 White Paper: Maintain Business Continuity With the Five9 Intelligent Cloud Contact Center 15
 Conclusion
Now that you have a better understanding of the Five9 Intelligent Cloud Contact
Center, you can see that our solutions are designed to help you maintain business
continuity before, during, and after any type of disruption. Five9 makes moving
to the cloud a positive, transformative experience, and empowers you with the
guidance to ensure your enterprise provides extraordinary experiences for your
customers and agents.
We’re here to help you determine the right path forward for your company as you
plan for your contact center’s future in the cloud. You can trust the Five9 Intelligent
Cloud Contact Center to help you ensure business continuity in any situation.
Read a case study to learn how Five9 helped a leading business process outsourcer
maintain business continuity and quickly scale to support a remote workforce while
delivering exceptional customer experiences.

About Five9
Five9 is a leading provider of cloud contact center solutions, bringing the power of the cloud
to more than 2,000 customers worldwide and facilitating more than five billion call minutes
annually. Five9 helps contact centers increase productivity, boost revenue, and create
customer loyalty and trust.
For more information visit www.five9.com or call 1-800-553-8159.

4000 Executive Parkway, Suite 400 Five9 and the Five9 logo are registered trademarks of Five9 and its subsidiaries in the United States and other countries. Other
marks and brands may be claimed as the property of others. The product plans, specifications, and descriptions herein are
San Ramon, CA 94583 provided for information only and subject to change without notice, and are provided without warranty of any kind, express or
925.201.2000 implied. Copyright © 2020 Five9, Inc. 12120

www.five9.com 16