BECHTLE LIMITED

Mimecast Email Security

Bechtle is able to provide market leading email security with our partner, Mimecast. Mimecast email security is a cloud-based platform providing comprehensive protection against advanced email threats like phishing, ransomware, and malware, while also managing spam, data leaks, and offering secure messaging and large file transfer.

Features

• Cloud based
• Anti-phishing
• Anti-spam
• Secure messaging
• Email continuity
• Data Leak Prevention (DLP)
• Secure Email Gateway
• Targeted Threat Protection

Benefits

• Single interface
• Simplified management
• AI
• Deep Scanning
• Stops advanced threats (BEC, ransomware, phishing)
• Increases visibility into email traffic
• Reduces reliance on risky third-party file-sharing services

• Education pricing available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at publicsector.uk@bechtle.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

249319103223851

Contact

Public Sector
01249 467900
publicsector.uk@bechtle.com

About your service

• Service categories:

  Applications

  Collaborative

  • Email
• Multi cloud support: Yes

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: DLP; Email Archiving
• Cloud deployment model: Community cloud
• Service constraints: Only one policy of each type generally applies to an email (with some exceptions like Content Examination).
• System requirements:
  • Modern Windows (10/11, Server 2016+)
  • MacOS (Sierra 10.13+)
  • Reliable internet
  • Compatible mail clients (Outlook)
  • Sufficient server resources (8GB RAM, 8 CPUs for migration tools)

User support

• Email or online ticketing support: No
• Phone support: No
• Web chat support: No
• Onsite support: No
• Support levels: Support is available, dependant on licencing and service wraparound. Cost is based on scale and complexity.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: We are able to provide a full on-boarding service, this includes; initial setup, optimisation of configuration, handover with full documentation.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: There is no requirement to extract email data when contract ends, as this is resident in customer email platform (Exchange etc).; For email archiving there may be costs associated with data extraction and import in to alternative platform.
• End-of-contract process: At end of contract the customer is notified in advance of service termination. Professional services may be required at additional cost to transition to alternative platform.
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: The service is cloud based so there is no difference to the user experience.
• Service interface: Yes
• User support accessibility: WCAG 2.2 AA
• Description of service interface: There is a unified console which allows admins to make changes and monitor email flows and blocked email traffic.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: Proofpoint has conducted accessibility evaluations of its products, A combination of automated and manual testing techniques was employed for the accessibility assessment.; ● Manual assessment was performed using Chrome/NVDA on Windows 10; ● Automated tools used included the Deque aXe browser extension & Deque aXe Auditor
• API: Yes
• What users can and can't do using the API: Service through the API can be setup using the the administrator console. Options for global (failover) or UK for data residency.; Limitations:; Rate limiting; Maximum content-length; Maximum historical lookup for date/time fields (queries); Maximum number of items permitted per tenant (lists)
• API documentation: Yes
• API documentation formats:
  • HTML
  • PDF
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Policies, workflows and user restrictions can be customised. ; Customisation is undertaken by admins using the Admin Console.

Scaling

• Independence of resources: Proofpoint manages user demand through a multi-layered approach involving technical, operational, and architectural strategies to ensure consistent service performance and reliability

Analytics

• Service usage metrics: Yes
• Metrics types: Proofpoint provides a range of service user metrics focused on user behavior, vulnerability, threat response, and data loss prevention (DLP), emphasizing a "people-centric" security approach. These metrics are available through various product dashboards and reports, such as the CISO Dashboard and Targeted Attack Protection (TAP) Dashboard.
• Reporting types:
  • API access
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: Yes
• FOCUS resource tagging: No

Resellers

• Supplier type: Reseller providing extra support
• Organisation whose services are being resold: Mimecast

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Developed Vetting (DV)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least every 6 months
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v4.0
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Physical access control, complying with another standard
  • Encryption of all physical media
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type: Deleted data can’t be directly accessed / Cryptographic Erasure

Data importing and exporting

• Data export approach: Proofpoint users export data through built-in web consoles, typically by searching, selecting items (emails, lists, activities, settings), choosing an export format (PST, EML, CSV, JSON, Excel), and initiating the job, with options to download or send to secure storage, depending on the specific Proofpoint product (Archive, ITM, BI).
• Data export formats: CSV
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: Roofpoint guarantees a high level of system availability, generally 99.999%, for its various cloud and hosted services as outlined in its Service Level Agreements (SLAs). The exact guarantee and specific terms can vary slightly depending on the specific product or service purchased, such as Secure Email Relay or the Email Archiving Hosted Service.
• Approach to resilience: Proofpoint achieves resilience through a multi-region, multi-cloud architecture with automated failover, ensuring continuity during localized outages, and uses an asynchronous processing model to queue messages safely, preventing data loss and ensuring security efficacy even when services are stressed. Key design elements include global redundancy, message queuing, continuous monitoring, rapid incident response, and low-impact endpoint agents, all supported by robust change management and secure development practices to maintain high availability and consistent protection.
• Outage reporting: Proofpoint reports service outages through a dedicated, non-public official status page on its customer community portal. This page is accessible to customers who have an account, which is typically managed through their assigned Account Manager (AM) or Technical Account Manager (TAM).

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
• Access restrictions in management interfaces and support channels: Proofpoint restricts access to its management interfaces and support channels using a combination of strong authentication, role-based access control (RBAC) with the principle of least privilege, and granular policy enforcement. These measures apply to both customer-facing consoles and Proofpoint's internal systems.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: Between 1 month and 6 months
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: Between 1 month and 6 months
• How long system logs are stored for: Less than 1 month

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards:
  • CSA CSM version 4.0
  • ISO/IEC 27001
• Information security policies and processes: Proofpoint maintains a comprehensive, documented information security program that aligns with industry standards such as NIST 800-53 and ISO 27001, led by their Chief Security Officer (CSO). This program is owned and administered by their Global Information Security group and involves continuous monitoring and regular third-party audits.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: Proofpoint's configuration and change management processes are defined by a formal, documented policy that emphasizes structured control over system modifications, operational stability, and security.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: Proofpoint's vulnerability management process is a continuous, risk-based cycle aligned with industry standards like NIST 800-53 and ISO 27001. It focuses on identifying, prioritizing, and remediating security weaknesses across its systems and products, particularly those related to identity, data, and cloud environments.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: Proofpoint's protective monitoring processes are an integral part of its security and compliance solutions, utilizing a people-centric approach that combines real-time data collection, behavioral analysis, threat intelligence, and automated response capabilities across email, cloud, and endpoint environments.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: Proofpoint's incident management processes are a systematic and planned approach, led by a trained Incident Response Team (IRT) and aligned with industry frameworks like NIST 800-53 and ISO 27001. The process is designed to detect, investigate, remediate, and communicate security incidents, leveraging automation and context-rich data to accelerate response times.
• Post-quantum cryptography secure: Yes

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: Yes
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0.01%
• Between £250,000 and £500,000: 0.01%
• Between £500,001 and £1,000,000: 0.5%
• Between £1,000,001 and £2,500,000: 0.5%
• Between £2,500,001 and £5,000,000: 1%
• Over £5,000,001: 2%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: British Assessment Bureau
• ISO/IEC 27001 accreditation date: Tuesday 4 February 2025
• What the ISO/IEC 27001 doesn’t cover: N/A
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: British Assessment Bureau
• ISO 9001 accreditation date: Tuesday 4 February 2025
• What the ISO 9001 doesn’t cover: N/A
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 1558ec47-32b1-40ed-b801-d45188947349
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: 96b7d157-8818-433b-b7f5-60dfc598a1ec
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

    Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

    • Understanding of how to influence staff, suppliers, customers, communities and/or any other appropriate stakeholders through the delivery of the contract to support climate and nature protection and improvement
    • Activities to reconnect people with the environment and increase awareness of ways to protect and enhance it

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at publicsector.uk@bechtle.com. Tell them what format you need. It will help if you say what assistive technology you use.