BECHTLE LIMITED

Sophos Central Email Security

Bechtle Sophos Email is a comprehensive, cloud-based security solution designed to protect organizations from a wide range of email-borne threats, including phishing, business email compromise (BEC), ransomware, spam, and malware. It is managed through a single, intuitive cloud console called Sophos Central and integrates with major email platforms.

Features

• Cloud based
• Anti-phishing
• Anti-spam
• Advanced Threat Protection
• Malware and URL Protection
• Anti-Spam and Authentication
• Spam/Virus FilterData Loss Prevention (DLP) and Encryption
• Insider Threat Management
• Email Encryption

Benefits

• Seamless Integration
• Deployment Flexibility
• Simplified Management
• Improved Efficiency and Continuity
• Enhanced Security Posture
• User Empowerment and Awareness
• Actionable Insights

• Education pricing available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at publicsector.uk@bechtle.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

982867771488276

Contact

Public Sector
01249 467900
publicsector.uk@bechtle.com

About your service

• Service categories:

  Applications

  Collaborative

  • Email
• Multi cloud support: Yes

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: DLP; Email Archiving
• Cloud deployment model: Community cloud
• Service constraints: Message Size Limit: Emails, including attachments, have a maximum size limit of 50 MB. Buyers dealing with larger file transfers may need to use alternative methods or compression (e.g., zipping files).; Email Rate Limits: To prevent spamming and potential IP blocking by external organizations, the service enforces specific sending and receiving limits.; Inbound: A recipient can receive a maximum of 3,600 emails per hour total, with a limit of 1,800 emails from a single sender in that same hour.
• System requirements:
  • Modern Windows (10/11, Server 2016+)
  • MacOS (Sierra 10.13+)
  • Reliable internet
  • Compatible mail clients (Outlook)
  • Sufficient server resources

User support

• Email or online ticketing support: No
• Phone support: No
• Web chat support: No
• Onsite support: No
• Support levels: Support is available, dependant on licencing and service wraparound. Cost is based on scale and complexity.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: We are able to provide a full on-boarding service, this includes; initial setup, optimisation of configuration, handover with full documentation.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: There is no requirement to extract email data when contract ends, as this is resident in customer email platform (Exchange etc).; For email archiving there may be costs associated with data extraction and import in to alternative platform.
• End-of-contract process: At end of contract the customer is notified in advance of service termination. Professional services may be required at additional cost to transition to alternative platform.
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: The service is cloud based so there is no difference to the user experience.
• Service interface: Yes
• User support accessibility: WCAG 2.2 AA
• Description of service interface: The Sophos email service interface is a single, intuitive cloud-based management console called Sophos Central, which unifies the management of email security with other Sophos security products. There is also a separate, user-friendly Self Service Portal (SSP) for end-users to manage their own quarantined emails and preferences.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: Sophos have tested with users and conform to WCAG 2.2 AA
• API: Yes
• What users can and can't do using the API: Sophos Mailflow uses Microsoft APIs to create mail flow rules in your Microsoft 365 environment, routing emails to Sophos and back to Microsoft without modifying your DNS and MX records.; ; Some Microsoft 365 subscriptions don't support inbound connectors. Before you begin, make sure your subscription allows you to create inbound connectors.
• API documentation: Yes
• API documentation formats:
  • HTML
  • PDF
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Policies, workflows and user restrictions can be customised. ; Customisation is undertaken by admins using the Admin Console.

Scaling

• Independence of resources: Sophos ensures that user performance is not degraded by the demands of other users through a combination of scalable cloud-native architecture, traffic shaping policies, and dedicated hardware acceleration in its physical appliances.

Analytics

• Service usage metrics: Yes
• Metrics types: There is a variety of service metrics that cover email traffic, security effectiveness, archiving performance, user activity, and service availability, which are accessible via its administration console, reports, and APIs.
• Reporting types:
  • API access
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: Yes
• FOCUS resource tagging: No

Resellers

• Supplier type: Reseller providing extra support
• Organisation whose services are being resold: Sophos

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Developed Vetting (DV)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least every 6 months
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v4.0
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Physical access control, complying with another standard
  • Encryption of all physical media
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type: Deleted data can’t be directly accessed / Cryptographic Erasure

Data importing and exporting

• Data export approach: Users can export different types of Sophos email data, primarily reports and individual quarantined emails, through the Sophos Central Admin interface in CSV or PDF formats. Direct bulk export of all mailbox contents (like a PST file in Outlook) is not a standard built-in feature of the Sophos security platform itself.
• Data export formats: CSV
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: Sophos Email is designed for high availability and resilience, hosted on public cloud platforms (AWS and Azure) that dynamically scale to handle workloads. Sophos does not offer a traditional Service Level Agreement (SLA) for the service's availability itself, but the management web portal has historically maintained an availability of 99.99% to 100%, depending on the region.
• Approach to resilience: Sophos email service is designed to be highly resilient through a multi-layered approach that includes cloud-native architecture, built-in email continuity, and deep integration with its broader security ecosystem.
• Outage reporting: Sophos provides a dedicated Sophos Status Page to report any outages, maintenance, or service disruptions. Administrators can monitor the status of various Sophos Central services, including email security, and subscribe to notifications for proactive alerts.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
• Access restrictions in management interfaces and support channels: Sophos restricts access to management interfaces and support channels using a combination of strong authentication, granular role-based access control (RBAC), and strict network-level access rules.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: Between 1 month and 6 months
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: Between 1 month and 6 months
• How long system logs are stored for: Less than 1 month

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards:
  • CSA CSM version 4.0
  • ISO/IEC 27001
• Information security policies and processes: Sophos follows a comprehensive information security framework that is based on leading industry practices and standards, including ISO 27001, NIST Cybersecurity Framework, SOX, and PCI DSS. The company has a dedicated cybersecurity team and a Security Operations Center (SOC) that manages its internal security posture.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: Sophos configuration and change management processes are generally managed through the cloud-based Sophos Central platform or individual device interfaces (like the WebAdmin console for Sophos Firewall/UTM), incorporating internal change control procedures for production environments.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: Sophos' vulnerability management process, both for its internal operations and as a managed service offered to customers (Sophos Managed Risk), follows an ongoing, risk-based lifecycle to identify, prioritize, and remediate security exposures. This process is integrated into their Secure Development Lifecycle (SDLC) for product development and delivered as a service to customers.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: Sophos' protective monitoring processes combine AI-powered technology with human expertise to provide 24/7 threat detection and response across endpoints, networks, and cloud environments. The core approach involves multiple layers of defense managed through the centralized Sophos Central platform.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: Sophos incident management follows a structured process: Identification (monitoring, testing, research), Assessment (severity based on impact), Containment, Eradication, and Recovery, culminating in Post-Incident Analysis for root cause and prevention. Their approach emphasizes rapid response, leveraging expert teams (like MDR) for 24/7 threat hunting, digital forensics, neutralization, and providing actionable security posture improvements, often starting with quick triage within hours for urgent cases.
• Post-quantum cryptography secure: Yes

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: Yes
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0.01%
• Between £250,000 and £500,000: 0.01%
• Between £500,001 and £1,000,000: 0.5%
• Between £1,000,001 and £2,500,000: 0.5%
• Between £2,500,001 and £5,000,000: 1%
• Over £5,000,001: 2%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: British Assessment Bureau
• ISO/IEC 27001 accreditation date: Tuesday 4 February 2025
• What the ISO/IEC 27001 doesn’t cover: N/A
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: British Assessment Bureau
• ISO 9001 accreditation date: Tuesday 4 February 2025
• What the ISO 9001 doesn’t cover: N/A
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 1558ec47-32b1-40ed-b801-d45188947349
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: 96b7d157-8818-433b-b7f5-60dfc598a1ec
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

    Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

    • Understanding of how to influence staff, suppliers, customers, communities and/or any other appropriate stakeholders through the delivery of the contract to support climate and nature protection and improvement
    • Activities to reconnect people with the environment and increase awareness of ways to protect and enhance it

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at publicsector.uk@bechtle.com. Tell them what format you need. It will help if you say what assistive technology you use.