Comprehensive Cybersecurity Coverage - Sophos Products Renewal

San Bernardino County Arrowhead Regional Medical Center (ARMC) issued a Request for Proposal on February 19, 2026, to procure Sophos cybersecurity products and licensing renewal services. The procurement seeks qualified proposers to provide XG Firewall licensing, server protection, endpoint protection, and User Awareness Training (UAT) capabilities to support ARMC's comprehensive cybersecurity infrastructure. Specific deliverables include three Sophos Xstream Protection licenses, 4,000 Sophos Central Intercept X Advanced with XOR licenses, 400 Sophos Central Intercept X Advanced for Server with XOR licenses, 9,999 Sophos Enhanced Plus Support licenses, and 6,000 Sophos Central Phish Threat licenses. The contract term spans five years, commencing September 7, 2026, and concluding September 6, 2031, with services to be provided at ARMC's main campus in Colton, California. Proposals must be submitted electronically through the San Bernardino County Electronic Procurement Network (ePro) by March 19, 2026, at 12 p.m. PST, with questions due by March 4, 2026. Evaluation will be based on qualifications and experience (30 percent), technical review (30 percent), cost and revenue (30 percent), and references (10 percent), with contract award anticipated in July 2026. Proposers must demonstrate no unsatisfactory performance history with the County in the preceding 24 months, possess proper licensing and certifications, comply with debarment and suspension requirements, and provide proof of adequate insurance coverage including general liability ($1,000,000), professional liability ($1,000,000), and cyber liability ($1,000,000).

The RFP does not indicate specific set-aside designations or restrictions limiting organizational eligibility to respond, nor does it identify incumbent vendors or current contractors. However, proposers must comply with HIPAA requirements and execute a Business Associate Agreement, indicating this is a healthcare procurement subject to federal health information privacy and security standards. All proposals must be submitted through the ePro system, and prospective bidders must register in advance or face disqualification. The procurement is non-exclusive, and ARMC reserves the right to reject any or all proposals, request best and final offers, conduct oral interviews or demonstrations, and award to multiple proposers based on proposal quality. No specific budget ranges or award values are detailed in the available RFP documentation, though the renewal nature of this procurement and the comprehensive scope of Sophos products and licensing suggest a substantial contract value. ARMC does not guarantee minimum work or compensation beyond a per-order basis.