ATTACHMENT_A_-_ISS_-_Enterprise_Security_Standards_-_External_Data_Hosting_Rev3.pdf

This document is an Enterprise Security Standards policy for External Data Hosting from the Orange County Government Board of County Commissioners (OCGBCC), establishing comprehensive standards for electronic data management. The policy outlines detailed requirements for vendors, networks, systems, and applications that will transmit, process, store, or handle electronic data provided by the county. Key policies include strict protocols for data input, processing, storage, handling, transmission, and disposal, with specific emphasis on protecting sensitive information such as social security numbers, bank information, usernames, passwords, and other personally identifiable data.

The document mandates field-level encryption for sensitive data at rest and in transit, prohibits direct access to county networks and active directory, and requires annual security audits through either penetration testing by Orange County ISS personnel or an external audit by a reputable third-party security company. Data disposal methods include sanitization (overwriting data), physical destruction of media, and data purging using magnetic devices. The policy was last revised in October 2017, with updates including specifying field-level encryption requirements, adding usernames and passwords to encryption lists, and providing alternative vendor audit options.