ATTACHMENT_A_-_ISS_-_Enterprise_Security_Standards_-_External_Data_Hosting_Rev3.pdf

This is an Enterprise Security Standards policy document issued by Orange County Government Board of County Commissioners (OCGBCC) that establishes mandatory security requirements for all vendors, networks, systems, and applications handling electronic data for the county. The policy applies specifically to external data hosting environments and covers the complete data lifecycle including retrieval, storage, transmission, processing, and handling of county data. The document prohibits hosted applications from accessing sensitive information including Social Security numbers, bank account information, Active Directory credentials, and internal network access. Sealed responses for the associated Intersection Automated Enforcement Safety System contract (Y26-135) are due by 4:00 pm EST on Tuesday, January 13, 2026, with submission required exclusively through the OpenGov e-Procurement Platform; hand-delivery, mail, telephone, fax, or email submissions will be rejected.

The security standards mandate field-level encryption for sensitive data including usernames, passwords, names, addresses, phone numbers, email addresses, birthdates, document numbers, account numbers, race or religious information, employee identification numbers, and all HIPAA and PCI information. Data must be encrypted both at rest and in transit through encrypted tunnels. When data is no longer needed, vendors must employ one of three disposal methods: sanitization through data overwriting, physical destruction of media, or purging using magnetic degaussing. External security validation is required annually through either Orange County ISS personnel conducting penetration testing or vendor-provided results from a reputable third-party security company. The policy was most recently revised in October 2017 to specify field-level encryption requirements and add third-party audit options.