ATTACHMENT_A_-_ISS_-_Enterprise_Security_Standards_-_External_Data_Hosting_Rev3.pdf

This document is an Enterprise Security Standards policy issued by Orange County Government Board of County Commissioners (OCGBCC) that establishes mandatory security requirements for vendors handling electronic data through external hosting arrangements. The policy applies to all vendors, networks, systems, and applications transmitting, processing, storing, or handling Orange County Government data and establishes comprehensive standards for data input, processing, storage, transmission, and disposal. Key requirements include prohibitions on hosted applications accessing Social Security Numbers, bank information, Active Directory usernames, or OCGBCC internal networks; field-level encryption of sensitive data including usernames, passwords, names, addresses, phone numbers, email addresses, birthdates, document numbers, account numbers, and HIPAA/PCI information both at rest and in transit; encryption of all data transmission within encrypted tunnels; and secure data disposal through sanitization, physical destruction, or purging using magnetic devices. The policy mandates that external services and applications pass yearly penetration testing conducted by Orange County Information Security Services personnel or provide results from an external audit by a reputable third-party security company, with documentation of compliance with information security best practices required from all vendors.

The document was originally issued in August 2012 and revised in October 2017 to clarify field-level encryption requirements, expand the list of sensitive data elements, and provide vendors the option to submit third-party security audit results in lieu of Orange County-conducted penetration testing. The policy defines key terms including bank information, electronic media, sanitization, and physical destruction, and references Florida Statute 119.071 regarding Social Security Number usage guidelines. This security standard directly applies to the School Zone Speed Detection Safety Program contract (Y26-131), where respondents must demonstrate full compliance with these enterprise security standards for violation processing software, payment collection platforms, data storage systems, and all applications handling sensitive citizen information collected through automated speed enforcement operations.