Attachment_2_ISS_-_Enterprise_Security_Standards_-_External_Data_Hosting.pdf

PDF 74 KB Posted Jun 23, 2022

Attached to: Orange County Corrections Electronic Mail Delivery System for Inmates and Other Related Services
Solicitation number: Y22-1010
Issued by: Orange County, Orlando City, Florida

About this file

Written by GovTribe AI · Jun 27, 2025

This document is an Enterprise Security Standards policy for External Data Hosting Standard issued by Orange County Government Board of County Commissioners (OCGBCC) in Florida. The policy establishes comprehensive guidelines for vendors, networks, systems, and applications that will transmit, process, store, or handle electronic data provided by the county. The standard specifies strict requirements for data input, processing, storage, handling, transmission, and disposal, with a particular emphasis on protecting sensitive information such as social security numbers, bank information, usernames, passwords, and personal identifying details.

The policy mandates field-level encryption for specific types of data both at rest and in transit, requires transmission within encrypted tunnels, and outlines precise methods for data disposal including sanitization, physical destruction, and magnetic purging. Vendors must ensure web hosting environments and applications are secured using information security best practices and must either pass a yearly penetration test conducted by Orange County ISS personnel or provide results from an external audit by a reputable third-party security company. The document was last revised in October 2017, with updates including specification of field-level encryption, addition of usernames and passwords to encryption requirements, and providing an alternative option for external security audits.

View the file

Other files

File	Type	Posted
Attachment_3_Orange_County_IT_Standards.pdf	PDF	Jun 23, 2022
Y22-1010-AV_FINAL.pdf	PDF	Jun 23, 2022

On GovTribe

Work with this file

Download the original file
Contacts named in this file
Similar government files
Ask GovTribe AI about this file

Try for free Login

Text version

The file's text, extracted by GovTribe without its formatting.

ENTERPRISE SECURITY STANDARDS, POLICIES, AND GUIDELINES

EXTERNAL DATA HOSTING STANDARD

1.0 Purpose

The

purpose

this

policy

establish

standard

order

execute

the

proper

retrieval,

storage,

transmission,

processing,

and

handling

electronic

data.

2.0 Scope

This

document

applies

all

vendors,

networks,

systems,

and

applications

that

will

transmit,

process,

store,

handle

electronic

data

provided

Orange

County

Government

Board

County

Commissioners

(OCGBCC).

3.0 Audience

This

document

intended

for

distribution

those

that

are

involved

the

retrieval,

storage,

transmission,

processing,

and

handling

electronic

data.

4.0 Policies

4.1 Data Input and Processing

4.1.1 Any

use

Social

Security

Number

information

shall

adhere

and

abide

Florida

Statutes,

specifically

F.S.

119.071.

4.1.2 The

hosted

application

shall

not

have

access

social

security

information.

4.1.3 The

hosted

application

shall

not

have

access

data

containing

bank

information.

4.1.4 The

hosted

application

shall

not

granted

direct

indirect

access

OCGBCC

Active

Directory

usernames.

4.1.5 The

hosted

application

shall

not

have

access

the

OCGCC

internal

DMZ

networks.

4.2 Data

Storage

and

Handling

4.2.1 Any

data

accessible

from

the

hosted

application

meeting

the

following

criteria

shall

encrypted	at	a	field-level	and	in	transit:	usernames,	passwords,	names,	addresses,
phone	numbers,	email	addresses,	birthdates,	federal/state/local	document	numbers,
account	numbers,	race	or	religious	information,	usernames,	passwords,	employee
identification	numbers	and	all	HIPAA	and	PCI	information.

4.2.2 Any

data

accessible

from

the

hosted

application

directly

accessible

from

should

encrypted

field

level.

4.3 Transmission	of	Data
4.3.1 Any	data	referenced	above	shall	be	transmitted	within	an	encrypted	tunnel.

4.4 Disposal

Data

Once

data

longer

needed

must

removed

from

the

system

shall

sanitized

and

disposed

using

one

the

methods

below:

4.4.1 Sanitization

Overwriting

data

previously

stored

disk

drive

with

random

pattern

meaningless

information.

4.4.2 Destruction

Physically

damaging

medium

that

not

usable

any

device

that

may

normally

used

read

information

the

media

such

computer,

tape

reader,

audio

video

player.

4.4.3 Purging

data

Using

strong

magnetic

devices;

such

degausser,

possible

render

data

unrecoverable.

4.5 External

Audit

4.5.1 The

vendor

must

ensure

that

the

web

hosting

environment

and

the

application

secured	using	information	security	best	practices.
4.5.2 The	external	service,	system,	and	application	must	pass	a	yearly	penetration	test

performed

Orange

County

ISS

personnel.

Alternatively

the

vendor

can

provide

the

results

external

audit

conducted

reputable

3rd

party

security

company.

5.0 Definitions

Term		Definition
Bank	Information	Checking	account	numbers,	credit	card	numbers,	or	any	unique	number

from

bank

institution.

Electronic

Media

Physical

objects

which

data

can

stored,

such

hard

drives,

zip

drives,

CD-ROMs,

DVDs,

USB

drives,

and

tapes.

Sanitization

expunge

data

from

storage

media

that

data

recovery

impossible.

Physical

Destruction

sanitization

method

for

optical

media,

such

CDs.

Florida

Statue

119.071

Detailed

guidelines

usage

Social

Security

information

6.0 Revision History

October	2017 Specified	“field-level	encryption”	for	sensitive	data	at	rest	in	4.2.1
Added	usernames	and	passwords	to	the	list	in	4.2.1
Added	an	option	for	a	3rd	party	vendor	in	4.5.2
Added	definition	for	field-level	encryption

August 2012 Added “Bank Information” to list of definitions in 5.0

File details come from the government source that posted it. Updated Jun 27, 2025.