Appendix_D_-_EnterpriseSecurityStandards-InternalApplicationsRev4.pdf

This document is an Enterprise Security Standards policy manual for the Orange County Government Board of County Commissioners (OCGBCC), detailing comprehensive technology security requirements across multiple domains including web security, sensitive data protection, encryption, antivirus protocols, and network access. The document establishes mandatory technical standards for information systems, covering areas such as web servers, database placement, account management, encryption algorithms, virus scanning, and network segmentation. It applies to all OCGBCC employees, consultants, and affiliated third parties operating within the organization's information systems and networks.

The security standards mandate specific technical controls including encryption of sensitive data using 128-bit minimum key lengths, restrictions on server configurations, protocols for virus protection, and guidelines for handling external devices and network access. Key requirements include using approved encryption ciphers like Triple-DES and RSA, implementing field-level encryption for sensitive information, mandating antivirus software on all systems, restricting administrative access, and establishing protocols for DMZ (demilitarized zone) network environments. The document also outlines enforcement mechanisms, which include potential disciplinary action up to and including termination of employment for violations of these security policies.