ATTACHMENT_A_-_ISS_-_Enterprise_Security_Standards_-_External_Data_Hosting_Rev3.pdf

This is an Enterprise Security Standards policy document issued by Orange County Government Board of County Commissioners (OCGBCC) in Florida, establishing mandatory security requirements for external data hosting vendors and service providers. The policy applies to all vendors, networks, systems, and applications that transmit, process, store, or handle electronic data on behalf of Orange County Government. The standard addresses data input and processing, storage and handling, transmission, and disposal protocols. Key requirements include prohibitions on hosted applications accessing Social Security numbers, bank information, Active Directory usernames, and internal or DMZ networks. The document was last revised in October 2017 and includes definitions of relevant security terms such as sanitization, physical destruction, and electronic media.

The policy mandates field-level encryption for sensitive data including usernames, passwords, names, addresses, phone numbers, email addresses, birthdates, federal/state/local document numbers, account numbers, race or religious information, employee identification numbers, and all HIPAA and PCI information. Data must be encrypted both at rest and in transit through encrypted tunnels. When data is no longer needed, it must be sanitized through overwriting with random patterns, physical destruction, or purging using magnetic devices. Vendors are required to ensure the web hosting environment and application meet information security best practices and must pass a yearly penetration test conducted by Orange County ISS personnel or provide results from an external audit performed by a reputable third-party security company. These standards are non-negotiable requirements for any vendor seeking to contract with Orange County Government for services involving external data hosting.