ATTACHMENT_A_-_ISS_-_Enterprise_Security_Standards_-_External_Data_Hosting_Rev3.pdf

This is an Enterprise Security Standards Policy document established by Orange County Government Board of County Commissioners that applies to all vendors, networks, systems, and applications handling electronic data for the County. The policy establishes mandatory security requirements for external data hosting environments and applies to any vendor transmitting, processing, storing, or handling County electronic data. The document outlines comprehensive requirements across data input and processing, storage and handling, transmission, and disposal, with specific prohibitions on vendor access to sensitive information including Social Security numbers, bank information, Active Directory credentials, and internal or DMZ networks. All sensitive data—including usernames, passwords, names, addresses, phone numbers, email addresses, birthdates, document numbers, account numbers, race or religious information, employee identification numbers, and HIPAA or PCI information—must be encrypted at the field-level and in transit. The standard requires annual penetration testing conducted either by Orange County Information Systems Services personnel or by a reputable third-party security firm, with vendors responsible for ensuring their web hosting environment and applications comply with information security best practices.

Data disposal must follow strict sanitization protocols using methods such as data overwriting with random patterns, physical destruction, or magnetic purging to render data unrecoverable. The policy was originally established in August 2012 and revised in October 2017 to clarify field-level encryption requirements, expand the list of encrypted data elements to include usernames and passwords, and add the option for third-party external audit providers. This Enterprise Security Standards document serves as a mandatory compliance requirement for the School Zone Speed Detection Safety Program (RFP Y26-131), with all system contractors required to demonstrate adherence to these security protocols including encrypted data handling, SAML-based single sign-on compatibility with multi-factor authentication, Sophos Anti-Virus compatibility, and data storage exclusively on servers within the continental United States.