Attachment_C_-_ISS_-_Enterprise_Security_Standards_-_External_Data_Hosting_Rev3.pdf

This is an Enterprise Security Standards policy document established by Orange County Government Board of County Commissioners (OCGBCC) governing external data hosting requirements for vendors handling electronic data. The policy establishes mandatory security standards for the retrieval, storage, transmission, processing, and handling of all electronic data provided by the County. The document applies to all vendors, networks, systems, and applications that interact with County data and is intended for distribution to personnel involved in data management operations.

The policy establishes comprehensive security controls across four primary areas: data input and processing restrictions that prohibit hosted applications from accessing Social Security numbers, bank information, Active Directory usernames, or internal networks; data storage and handling requirements mandating field-level encryption and in-transit encryption for sensitive information including usernames, passwords, names, addresses, phone numbers, email addresses, birthdates, document numbers, account numbers, race or religious information, employee identification numbers, and all HIPAA and PCI information; data transmission requirements specifying that all referenced data must be transmitted within encrypted tunnels; and data disposal standards permitting sanitization through data overwriting, physical destruction, or magnetic purging methods. Section 4.5 requires vendors to ensure web hosting environments and applications are secured using information security best practices and mandate that external services, systems, and applications pass yearly penetration testing performed by Orange County ISS personnel or provide results from an external audit conducted by a reputable third-party security company. The policy was last revised in October 2017 with clarifications regarding field-level encryption specifications and the addition of third-party audit options as an alternative to internal penetration testing.