Professional Services
forCentral Products

Updated July 2024

Table of Contents
Central Endpoint/Server - Foundations ..................................................................................................................................................... 3
Central Endpoint/Server - Essentials ......................................................................................................................................................... 4
Central Endpoint/Server - Enterprise......................................................................................................................................................... 5
Central Endpoint/Server + MDR Integrations ............................................................................................................................................ 6
Central Email – Essentials .......................................................................................................................................................................... 7
Central Mobile - Essentials......................................................................................................................................................................... 8
Central Device Encryption - Foundations................................................................................................................................................... 9Central Endpoint/Server Health Check .................................................................................................................................................... 10
Security Posture Assessment ................................................................................................................................................................... 11

Professional Services Central Products

Page 2 of 12

Product Code: PCBZTCCAA

SKU: PRPCBA00ZZPCAACentral Endpoint/Server - Foundations
This service is delivered remotely for a duration of half a day or for a total of up to 4 hours.
The Central Endpoint/Server - Foundations service is intended for organizations with a single location and basic requirements for
Endpoint and Server protection. The Professional Services engineer will assist with the deployment of the Sophos Central client
software and provide basic guidance and knowledge transfer. This enables your IT staff to become familiar with the key concepts
in the configuration and management of the Sophos Central Endpoint/Server security solution.
The following is an outline of the tasks and knowledge transfer that may be completed during a Sophos Central Endpoint/Server Foundations engagement.

Activities
•
•

•

•

•

•
•
•

Activation of Sophos Central License(s)Endpoint/Server deployment planningo Competitor removal review/testing (1product version)o Devise installation process▪ GPO,3rd party tools (e.g. SCCM,
PDQ, etc.)
o Review installation logs
o Deployment testing (up to 5 devices)
Endpoint/Server Agent GUIo Tamper Protectiono Events/Logging
o Self-Help
Knowledge transfer and configuration of
Endpoint/Server Base Policies
o Threat Protection▪ Defining Exclusionso Peripheral Control
o Web Control
Logs and Reports
o Events
o Custom Reportso Schedulingo Audit Logs
Review/Implement Active Directory Synchronization
Communicating with Sophos Technical Support
o Gathering Diagnose logs
Q&A (as time permits)

Professional Services Central Products

Implementation Process•

We begin with a 1-hour planning/kick-off meeting toreview the technical requirements and pre-requisites
to prepare for the implementation.

Page 3 of 12

Product Code: PCDZTCCAA

SKU: PRPCDZ00ZZPCAACentral Endpoint/Server - Essentials
This service is delivered remotely for a duration of 1 day or for a total of up to 8 hours.
The Central Endpoint/Server - Essentials is intended for organizations with diverse operational requirements including but notlimited to integration with a SIEM solution and configuring Update Cache/Message relays. The Professional Services engineer willassist with the deployment of the Sophos Central client software and provide guidance and knowledge transfer. This enables
your IT staff to become familiar with the key concepts in the configuration and management of the Sophos Central
Endpoint/Server security solution.
The following is an outline of the tasks and knowledge transfer that may be completed during a Sophos Central Endpoint/Server Essentials engagement.

Activities
•
•

•

•

•
•

•

Activation of Sophos Central License(s)Endpoint/Server deployment planningo Competitor removal review/testing▪ Up to 4 products/versionso Devise installation process▪ GPO,3rd party tools (e.g., SCCM,
PDQ, etc.)
o Review installation logs
o Deployment testing (up to 10 devices)
Endpoint/Server Agent GUIo Tamper Protectiono Events/Logging
o Self-Help
Review and configuration of up to 2 each of thefollowing policies
o Threat Protection▪ Defining Exclusionso Peripheral Control
o Application Control
o Web Control
o Update Managemento Windows Firewall
Overview of Server Lockdown and File Integrity
Monitoring concepts
Logs and Reports
o Events
o Custom Reportso Schedulingo Audit Logs
Threat Caseso Live DiscoverProfessional Services Central Products

•
•
•
•
•
•

•

Review/Implement Active Directory Synchronization
Installation of up to 2 Update Cache/Message Relay
Sophos Central Alertingo Configuration of Email Alerting
API Token Management for SIEM Integration
Communicating with Sophos Technical Support
o Gathering Diagnose logs
Continued deployment assistance toEndpoints/Servers during the engagemento The number of devices deployed is wholly
dependent on the customer
Q&A (as time permits)

Implementation Process•

We begin with a 1-hour planning/kick-off meeting toreview the technical requirements and pre-requisites
to prepare for the implementation.

Page 4 of 12

Product Code: PDXZTCCAA

SKU: PRPDXA00ZZPCAACentral Endpoint/Server - EnterpriseThis service is delivered remotely for a duration of 2 days or for a total of up to 16 hours.
The Central Endpoint/Server - Enterprise is intended for larger organizations with more complex network and operational
requirements. The Professional Services engineer will assist with the enablement of Enterprise Dashboard and the deploymentof the Sophos Central client software and provide guidance and knowledge transfer. This enables your IT staff to become familiar
with the key concepts in the configuration and management of the Sophos Central Endpoint/Server security solution in anenterprise environment.
The following is an outline of the tasks and knowledge transfer that may be completed during a Sophos Central Endpoint/Server Enterprise engagement.

Activities
•

•

•

•

•
•

•

Activation of Sophos Central License(s)o Activation of Enterprise Dashboard andEnablement of Master Licensing (ifrequired)Enterprise Dashboard Configuration/Review
o Enterprise Installer vs Sub-estate Installero Enterprise Administration Roleso Global Templates Concepts
Endpoint/Server deployment planningo Competitor removal review/testing (up to 5
products/versions)o Devise installation process
o Review installation logs
o Deployment testing (up to 20 devices)o Disk Imaging for VDI
Review and configuration of up to 2 each of thefollowing policies
o Threat Protection▪ Defining Exclusionso Peripheral Control
o Application Control
o Web Control
o Windows Firewall
Policy Assignment - Device vs User
Logs and Reports
o Events
o Custom Reportso Schedulingo Audit Logs
Threat Caseso Live DiscoverProfessional Services Central Products

•

•
•
•

•
•

•

Endpoint/Server Agent GUIo Tamper Protectiono Events/Logging
o Self-Help
Review/Implement Active Directory Synchronization
Installation of up to 2 Update Cache/Message Relay
Sophos Central Alertingo Configuration of Email Alertingo API Token Management for SIEM
Integration
Communicating with Sophos Technical Support
Continued deployment assistance ofEndpoints/Servers during the engagement.
o The number of devices deployed is wholly
dependent on the customer.
Q&A (as time permits)

Implementation Process•

We begin with a 1-hour planning/kick-off meeting toreview the technical requirements and pre-requisites
to prepare for the implementation.

Page 5 of 12

Product Code: PDRZTCCAA

SKU: PRPDRA00ZZPCAACentral Endpoint/Server + MDR Integrations
This service is delivered remotely for a duration of 1 day or for a total of up to 8 hours.
The Central Endpoint/Server + MDR Integrations service is intended for organizations with a single location and basic
requirements for Endpoint and Server protection and NDR Sensor or MDR Integrations. A Professional Services engineer willassist with the deployment of the Sophos Central client software and provide basic guidance and knowledge transfer. In
addition, an engineer will assist with the deployment of the Sophos NDR Sensor and/or MDR Integration software and provide
guidance and knowledge transfer. This enables your IT staff to become familiar with the key concepts in the configuration andmanagement of the Sophos Central Endpoint/Server security solution.
The following is an outline of the tasks and knowledge transfer that may be completed during a Sophos Central Endpoint/Server +MDR Integrations engagement.

Activities
•
•

•

•

•

•
•
•

Activation of Sophos Central License(s)Endpoint/Server deployment planningo Competitor removal review/testing (1product version)o Devise installation process▪ GPO,3rd party tools (e.g. SCCM,
PDQ, etc.)
o Review installation logs
o Deployment testing (up to 5 devices)
Endpoint/Server Agent GUIo Tamper Protectiono Events/Logging
o Self-Help
Knowledge transfer and configuration of
Endpoint/Server Base Policies
o Threat Protection▪ Defining Exclusionso Peripheral Control
o Web Control
Logs and Reports
o Events
o Custom Reportso Schedulingo Audit Logs
Review/Implement Active Directory Synchronization
Communicating with Sophos Technical Support
o Gathering Diagnose logs
Q&A (as time permits)

Professional Services Central Products

•
•
•

•
•
•

•

•

•

•
•

Implementation of up to 2 NDR Sensors or 2 MDR
Integration Packs or 1 of each
Downloading of OVA for VMware (as needed)
Installation of OVA Template for NDR Sensor or Log
Collector (as needed)o Configuration of virtual host
▪ CPU
▪ RAM
▪ HDD
▪ NICsBest practice walk-through of Initial Setup Wizard
Creation of LAN & WAN interfaces
Registration of NDR Sensor
o Synchronization with Sophos Licensing
Servers
Configuration of NDR Sensoro Enabling HTTPS WANo Enabling Discover (TAP) Modeo Enabling ATP
o Registering with Sophos Central
Discussion on gathering network traffico Creation of SPAN port
o Attaching SPAN port to virtual NIC
Verifying NDR Sensor data collectiono Checking interfaces in GUI and CLIo Contacting Sophos NDR Team
Walk through of Sophos Central NDR Reporting
Q&A (as time permits)

Page 6 of 12

Product Code: PGBZTCCAA

SKU: PRPGBA00ZZPCAACentral Email – Essentials
This service is delivered remotely for a duration of 1 day or for a total of up to 8 hours. It is intended for organizations with up to
5 email domains/zones.
The Professional Services engineer will assist with the configuration, knowledge transfer, guidance, and assistance with thecutover from your current solution. This will ensure a successful cutover to Sophos Central Email and enable your IT staff tobecome familiar with the key concepts in the configuration and management of the Sophos Central Email solution.
The following is an outline of the tasks and knowledge transfer that may be completed during a Sophos Central Email - Essentials
engagement.

Activities
•
•

•

•

•

Activation of Sophos Central License(s)Email Gateway deployment planningo Review current mail rules▪ Block/Allow lists▪ Approved URLs
▪ VIP management
Review/implement Active Directory/Azure AD
synchronizationo Or import users/distribution lists from othersources
Configurationo Email Security Policies▪ SPAM▪ Banners▪ Quarantine/ User Self-Help▪ Sender checks▪ Malware Scanning▪ Time-of-click▪ VIP Managemento Data Loss Prevention Policies▪ Attachment/Keyword handling▪ Email Encryption▪ Built-in templates
Cutovero DNS changes (up to 5 domains/zones)▪ MX/SPF/DKIM records
o O365 modifications▪ Mail flow changes for inbound andoutbound mailo On-Premises Exchange▪ Connectors for inbound andoutbound mailo Other mail providers compatible with
Sophos Email Gateway

Professional Services Central Products

•
•
•

•
•

Review Logs and Reporting
Communicating with Sophos Technical Support
Cutover Assistanceo Verify DNS records
o Verify mail flow and policies
o Verify Block/Allow listso Verify mail logs and quarantine items
Scheduled post-cutover assistanceo Next business day after cutover
Q&A (as time permits)

Implementation Process••

We begin with a 1-hour planning/kick-off meeting toreview the technical requirements and pre-requisites
to prepare for the implementation.
The engineer will coordinate follow-up meetings
during the initial call for the configuration, cutover
and a post-cutover call.
NOTE: If you have more than 5 email domains/zones,
additional services hours may be required tocomplete your implementation.

Page 7 of 12

Product Code: PD2ZTCCAA

SKU: PRPD2A00ZZPCAACentral Mobile - Essentials
This service is delivered remotely for a duration of 1-day or for a total of up to 8-hours.
The Professional Services engineer will assist with the deployment of the Sophos Mobile client software and provide guidance
and knowledge transfer. This enables your IT staff to become familiar with the key concepts and advanced features in theconfiguration and management of the Sophos Mobile security solution.
The following is an outline of the tasks and knowledge transfer that may be completed during a Sophos Mobile - Essentials
engagement.

Activities
•
•

•

•
•
•
•

•

•
•
•

Activation of Sophos Central License(s)Device Configurationo Apple iOS
o Apple OSXo Androido Chromeo Windows
Policy Creation and Assignmento Usero Deviceo Compliance
Configure Mobile Email access
Configure EAS Proxy
Application Deploymento App Groups
Mobile Threat Defenseo 3rd party integrations (e.g. InTune,
Airwatch, etc.)
Logs and Reports
o Events
o Custom Reportso Schedulingo Audit Logs
Deployment testingo Up to 10 devices
Mobile Control Agent GUI
Review/Implement Active Directory Synchronization

Professional Services Central Products•••

Sophos Central Alertingo Configuration of Email Alerting
Communicating with Sophos Technical Support
o Gathering Diagnose logs
Q&A (as time permits)

Implementation Process•

We begin with a 1-hour planning/kick-off meeting toreview the technical requirements and pre-requisites
to prepare for the implementation.

Page 8 of 12

Product Code: PD3ZTCCAA

SKU: PRPD3A00ZZPCAACentral Device Encryption - Foundations
This service is delivered remotely for a duration of a half-day or for a total of up to 4-hours.
The Professional Services engineer will assist with the deployment of the Sophos Central Device Encryption client software andprovide guidance and knowledge transfer. This enables your IT staff to become familiar with the key concepts in theconfiguration and management of the Sophos Central Device Encryption security solution.
The following is an outline of the tasks and knowledge transfer that may be completed during a Sophos Central Device Encryption– Foundation engagement.

Activities
•
•
•
•

•

•

•

•
•

Activation of Sophos Central License(s)Review and configuration of up to 2 Device Encryption policies
Policy Assignment
Endpoint deployment planningo Review process for migration from current producto Review Bitlocker requirements on Endpoints
o Review Group Policy Objects for Bitlocker
o Devise installation process▪ Review setup of software deployment via GPO
or 3rd party tools▪ Provide installation scripto Review installation logs
o Deployment testing▪ Up to 5 devices
Endpoint Recovery Procedureso Retrieve Recovery Keyo Change Bitlocker Authentication Passcode
Endpoint Agent GUIo Tamper Protectiono Events/Logging
o Self-Help
Logs and Reports
o Events
o Custom Reportso Schedulingo Audit Logs
Communicating with Sophos Technical Support
o Gathering Diagnose logs
Q&A (as time permits)

Professional Services Central Products

Implementation Process•

We begin with a 1-hour planning/kick-off
meeting to review the technicalrequirements and pre-requisites toprepare for the implementation.

Page 9 of 12

Product Code: PH4ZTCCEP

SKU: PRPH4E00ZZPCAACentral Endpoint/Server Health Check
This service is delivered remotely for a duration of a half-day or for a total of up to 4-hours.
The purpose of the Central Endpoint Health Check is to assess the current Sophos Central Endpoint/Server policies and provide
recommendations to help improve your organization’s security posture using Sophos Central. The delivery time consists of aremote teleconference meeting of approximately 2 hours. After the meeting, the engineer will compile the results and provide
documentation within 2 business days.
The goal is to understand, document, and advise on your current configuration. It is not intended to perform troubleshooting or
impact any immediate changes to the environment or resolve open issues.
The engineer will review and provide guidance on the following:•••

Global Settingso General▪ Role Management▪ API Credentials▪ Tamper Protection▪ Website Management▪ Global Exclusions▪ Allowed Applications▪ Manage Update Caches and Message Relays▪ HTTPS Updating▪ Configure email alerts
o Endpoint Protection▪ Controlled Updates▪ SSL/TLS decryption of HTTPS websites▪ Data Lake uploads (XDR only)o Server Protection▪ Controlled Updates▪ Data Lake uploads (XDR only)
Endpoint Policies (up to 2 of each policy type)o Endpoint Threat Protection▪ Exclusionso Peripheral Control
o Web Control
o Update Management
Server Policies (up to 2 of each policy type)o Server Threat Protection▪ Exclusionso Peripheral Control
o Web Control
o Update Management
o File Integrity Monitoring

Professional Services Central Products

Page 10 of 12

Product Code: PCAZ3CCAA

SKU: PCAZ3C00ZZPCAASecurity Posture Assessment
The goal is to understand and advise on your current security posture and is not intended to perform troubleshooting or impact
any immediate changes to the environment or resolve open issues. The Security Posture Assessment begins with a conference
call and remote screen sharing session which may last up to 4 hours. The following will be performed during the meeting anddocumentation will be provided within 10 business days.

Activities
Sophos Central Health CheckNIST Assessment

Our Health Check of your Central environment is designed tomake sure you are following our best practices, ensuring you
get the most out of our endpoint solution.

The NIST Cyber Security Framework is voluntary guidance,
based on existing standards, guidelines, and practices fororganizations to better manage and reduce cybersecurity risk.
Completing the assessment will provide you a report giving
insight into your organization’s current maturity. You will
have actionable recommendations to improve your security
posture.

The engineer will review and provide guidance on thefollowing:•••

Global Settingso General▪ Tamper Protection▪ Global Exclusions▪ HTTPS Updating▪ Multi-factor Authentication (MFA)o Endpoint Protection▪ Controlled Updateso Server Protection▪ Manage Update Caches andMessage Relays▪ Controlled Updates
Endpoint Policies (up to 2 of each policy type)o Endpoint Threat Protectiono Peripheral Control
o Web Control
Server Policies (up to 2 of each policy type)o Server Threat Protectiono Peripheral Control
o Web Control
o File Integrity Monitoring

Professional Services Central Products

EASM and Dark Web Scanning
The final task we will perform is an external device discovery
scan, locating systems that are available on the public
internet. We will complete vulnerability scans on thesedevices to assess if they are susceptible to attack. Finally, we
will look to see if any of your corporate information can befound on the Dark Web.

Page 11 of 12

United Kingdom and Worldwide Sales
Tel: +44 (0)8447 671131
Email: sales@sophos.com

North American Sales
Toll Free: 1-866-866-2802
Email: nasales@sophos.com© Copyright 2024. Sophos Ltd. All rights reserved.
Registered in England and Wales No. 2096520, The Pentagon, Abingdon Science Park, Abingdon, OX14 3YP, UK
Sophos is the registered trademark of Sophos Ltd. All other product and company names mentioned
are trademarks or registered trademarks of their respective owners.

Australia and New Zealand Sales
Tel: +61 2 9409 9100
Email: sales@sophos.com.au

Asia Sales
Tel: +65 62244168
Email: salesasia@sophos.com