ATTACHMENT_A_-_ISS_-_Enterprise_Security_Standards_-_External_Data_Hosting_Rev3.pdf

This is an Enterprise Security Standards policy document issued by Orange County Government Board of County Commissioners (OCGBCC) establishing requirements for external data hosting and the handling of electronic data by vendors, networks, systems, and applications that process County information. The policy establishes comprehensive security standards applicable to all vendors transmitting, processing, storing, or handling electronic data on behalf of Orange County. Key requirements include prohibitions on hosted applications accessing Social Security Numbers, bank information, Active Directory usernames, or internal/DMZ networks; field-level encryption of sensitive data including names, addresses, phone numbers, email addresses, birthdates, document numbers, account numbers, and HIPAA/PCI information both at rest and in transit; and encrypted transmission of all sensitive data within encrypted tunnels. The document also mandates secure data disposal through sanitization, physical destruction, or purging using strong magnetic devices, and requires vendors to pass yearly penetration testing either through Orange County Information Security Services personnel or through a reputable third-party security company external audit to ensure the web hosting environment and application meet information security best practices.

The policy was originally established in August 2012 and revised in October 2017 to specify field-level encryption requirements, add usernames and passwords to sensitive data lists, and provide vendors the option to submit results from external third-party security audits rather than exclusively relying on County-conducted penetration testing. This document serves as a mandatory compliance standard for the School Zone Speed Detection Safety Program contract (Y26-131) and establishes the security framework within which all external data hosting services must operate, including requirements for encryption protocols, access restrictions, audit compliance, and data sanitization procedures that bidders must acknowledge and implement in their proposed solutions.