Appendix_D_-_EnterpriseSecurityStandards-InternalApplicationsRev4.pdf

This document is an Enterprise Security Standards, Policies, and Guidelines document for the Orange County Government Board of County Commissioners (OCGBCC), covering multiple technology security domains including web security, sensitive data and encryption, DMZ security, antivirus standards, and internal applications security. The comprehensive standards document establishes detailed requirements for web servers, databases, network access, encryption protocols, virus protection, and overall information systems security across the county's technological infrastructure.

The document specifies technical standards such as requiring Microsoft Internet Information Server (IIS) version 5.0 or higher as the primary web server platform, mandating encryption algorithms with key lengths of at least 128 bits, establishing protocols for sensitive data protection, and defining requirements for virus scanning, antivirus software, and network access. Key security provisions include field-level encryption for sensitive data, restrictions on anonymous account access, requirements for administrative privileges, guidelines for external device management, and enforcement mechanisms that may include disciplinary action up to termination for policy violations. The standards apply to all OCGBCC employees, consultants, and affiliated third parties operating within the county's information systems and networks.