Attachment_C_-_ISS_-_Enterprise_Security_Standards_-_External_Data_Hosting_Rev3.pdf

This document is an Enterprise Security Standards policy established by Orange County Government Board of County Commissioners (OCGBCC) for external data hosting environments. The policy applies to all vendors, networks, systems, and applications that transmit, process, store, or handle electronic data on behalf of the County and establishes comprehensive security requirements governing data input, processing, storage, transmission, and disposal. Key requirements include prohibitions on hosted applications accessing Social Security numbers, bank information, Active Directory usernames, or OCGBCC internal networks; encryption of sensitive data fields at rest and in transit, including usernames, passwords, names, addresses, phone numbers, email addresses, birthdates, document numbers, account numbers, and HIPAA/PCI information; and secure data disposal through sanitization, physical destruction, or purging methods. The policy mandates that external services and applications pass yearly penetration testing conducted by Orange County ISS personnel or alternatively provide results from a reputable third-party security company, with vendors required to ensure web hosting environments and applications are secured using information security best practices.

The document was originally adopted in August 2012 and underwent revision in October 2017 to specify field-level encryption requirements for sensitive data at rest, expand the list of protected data elements to include usernames and passwords, and provide vendors the option to conduct third-party security audits as an alternative to Orange County-administered penetration testing. This policy directly supports the County's Corrections Jail Management System procurement (RFP Y25-101-KS), which requires vendors to comply with extensive security standards including field-level data encryption and yearly penetration testing while managing sensitive inmate and operational data within a correctional facility environment serving approximately 900 concurrent users and 5,175 beds.