Appendix_D_-_EnterpriseSecurityStandards-InternalApplicationsRev4.pdf

This document is an Enterprise Security Standards document for the Orange County Government Board of County Commissioners (OCGBBC), covering comprehensive cybersecurity policies and guidelines across multiple technology domains including web security, sensitive data protection, encryption, antivirus protocols, and network access standards. The document establishes detailed technical requirements for information systems security, encompassing server configurations, data handling, encryption algorithms, access controls, and virus protection measures applicable to all OCGBCC information systems, networks, and digital infrastructure.

The security standards mandate specific technical controls such as using Microsoft Internet Information Server (IIS) version 5.0 or higher as the primary web server platform, implementing field-level encryption for sensitive data, requiring 128-bit encryption for SSL certificates, and enforcing strict antivirus protocols across all computing devices. Key requirements include separating database and web servers, implementing low-privilege account access, encrypting laptop hard drives, scanning all incoming and outgoing internet email through a Barracuda Appliance, and maintaining comprehensive virus protection using Sophos Anti-Virus across servers and workstations. The document also establishes enforcement mechanisms that may include disciplinary action up to employment termination for policy violations, underscoring the critical nature of these security standards for the county's technological ecosystem.