ATTACHMENT_A_-_ISS_-_Enterprise_Security_Standards_-_External_Data_Hosting_Rev3.pdf

This is an Enterprise Security Standards policy document issued by Orange County Government Board of County Commissioners (OCGBCC) that establishes mandatory security requirements for external data hosting vendors supporting the Intersection Automated Enforcement Safety System procurement (Y24-1099). The policy applies to all vendors, networks, systems, and applications that transmit, process, store, or handle electronic data for Orange County Government. The document establishes comprehensive security protocols governing data input and processing, storage and handling, transmission, and disposal of electronic information. Key requirements include prohibitions on hosted applications accessing social security numbers, bank information, Active Directory usernames, or internal OCGCC networks; field-level encryption for sensitive data including personally identifiable information, HIPAA and PCI data both at rest and in transit; and mandatory data sanitization or destruction through overwriting, physical destruction, or degaussing when data is no longer needed. The policy was last revised in October 2017 to specify field-level encryption standards and include options for third-party security audits.

The security standards require vendors to ensure web hosting environments and applications comply with information security best practices and pass yearly penetration testing conducted either by Orange County ISS personnel or by a reputable third-party security company. All data transmissions must occur within encrypted tunnels, and vendors must maintain compliance with Florida Statute 119.071 regarding Social Security Number usage. These security requirements are fundamental to the vendor evaluation process for the Intersection Automated Enforcement Safety System project, which involves processing traffic violation data and managing back-office operations for up to 100 red light cameras across 44 intersections with a ten-year contract term beginning March 1, 2025.