Attachment_C_-_ISS_-_Enterprise_Security_Standards_-_External_Data_Hosting_Rev3.pdf

This is an Enterprise Security Standards policy document applicable to Orange County Government Board of County Commissioners (OCGBCC) in Florida for external data hosting vendors supporting the Corrections Jail Management System (Y25-101-KS). The policy establishes mandatory security requirements for all vendors, networks, systems, and applications that transmit, process, store, or handle electronic data on behalf of the County. The document outlines comprehensive data protection standards governing data input and processing, storage and handling, transmission, and disposal. Sealed responses for the Corrections Jail Management System are due by 4:00 pm EST on Thursday, January 8, 2026, submitted electronically through the OpenGov e-Procurement Platform only.

The security standards prohibit hosted applications from accessing social security numbers, bank information, Active Directory usernames, or OCGBCC internal or DMZ networks. Field-level encryption is required for sensitive data including usernames, passwords, names, addresses, phone numbers, email addresses, birthdates, document numbers, account numbers, race or religious information, employee identification numbers, and all HIPAA and PCI information both at rest and in transit within encrypted tunnels. Data disposal must utilize sanitization, physical destruction, or purging methods. Vendors must ensure the hosting environment meets information security best practices and pass a yearly penetration test conducted by Orange County ISS personnel or provide results from an external audit by a reputable third-party security company. The document was most recently revised in October 2017 to specify field-level encryption requirements and expand third-party audit options.