ATTACHMENT_A_-_ISS_-_Enterprise_Security_Standards_-_External_Data_Hosting_Rev3.pdf

This is an Enterprise Security Standards policy document established by Orange County Government Board of County Commissioners (OCGBCC) in Florida to govern the external data hosting practices of all vendors, networks, systems, and applications that handle electronic data on behalf of the County. The policy establishes mandatory requirements for the retrieval, storage, transmission, processing, and handling of sensitive information, with particular emphasis on protecting personally identifiable information, financial data, and protected health information. Vendors must ensure that applications do not have access to Social Security numbers, bank information, Active Directory credentials, or County internal networks. All sensitive data—including usernames, passwords, names, addresses, phone numbers, email addresses, birthdates, document numbers, account numbers, and HIPAA and PCI information—must be encrypted at the field level both at rest and in transit within encrypted tunnels.

The policy further requires vendors to implement secure data disposal methods including sanitization through data overwriting, physical destruction of media, or magnetic purging when data is no longer needed. External security validation is mandatory, with vendors required to pass yearly penetration testing conducted by Orange County ISS personnel or provide results from a reputable third-party security firm demonstrating compliance with information security best practices. The document was last revised in October 2017 to clarify field-level encryption requirements and expand acceptable third-party audit options. This standard applies to the County's School Zone Speed Detection Safety Program (Y26-131), for which sealed responses were due by March 24, 2026, submitted exclusively through the OpenGov e-Procurement Platform.