Attachment_1-External_Data_Hosting.pdf

This document is an Enterprise Security Standards, Policies, and Guidelines document for External Data Hosting Standard issued by Orange County Government Board of County Commissioners (OCGBCC). The policy establishes comprehensive security requirements for vendors, networks, systems, and applications that will transmit, process, store, or handle electronic data for the county. The standard covers critical aspects of data management, including strict protocols for handling sensitive information such as Social Security numbers, bank information, and personal identifiers.

The policy mandates rigorous security measures including field-level encryption for specific data types, transmission within encrypted tunnels, and specific data disposal methods like sanitization, physical destruction, and magnetic purging. Vendors must ensure their web hosting environment follows information security best practices and must either pass a yearly penetration test conducted by Orange County ISS personnel or provide results from an external audit by a reputable third-party security company. The document was last revised in October 2017, with updates including specifying field-level encryption requirements, adding usernames and passwords to encryption lists, and providing alternative audit options.