Attachment_C_-_ISS_-_Enterprise_Security_Standards_-_External_Data_Hosting_Rev3.pdf

This is an Enterprise Security Standards policy document issued by Orange County Government Board of County Commissioners (OCGBCC) establishing external data hosting requirements for vendors handling electronic data. The policy applies to all vendors, networks, systems, and applications transmitting, processing, storing, or handling Orange County Government data and establishes mandatory security standards for the Corrections Jail Management System procurement (Y25-101-KS). Sealed electronic responses must be submitted through the OpenGov e-Procurement Platform by January 8, 2026, at 4:00 pm EST, with alternative submission deadlines of March 5, 2026, and March 12, 2026. A non-mandatory pre-bid meeting is scheduled for December 3, 2025, at 11:00 am, with written questions due by December 10, 2025, at 5:00 pm EST. The contract term is five years with optional renewal provisions.

The policy mandates comprehensive security controls including field-level encryption for sensitive data such as usernames, passwords, names, addresses, phone numbers, email addresses, birthdates, document numbers, account numbers, and all HIPAA and PCI information. Vendors are explicitly prohibited from accessing Social Security numbers, bank information, Active Directory credentials, or internal OCGBCC networks. All data transmission must occur within encrypted tunnels, and data disposal must follow sanitization, destruction, or purging methodologies. The vendor must ensure yearly penetration testing either through Orange County ISS personnel or through a reputable third-party security company audit. The County requires comprehensive insurance coverage including $1 million in Commercial General Liability, $1 million in Professional E&O, $5 million in Network Security Liability, and $1 million in Fidelity/Crime Liability. Vendors must demonstrate previous implementation experience in correctional facilities with 1,000 or more beds and comply with FBI CJJIS Security Policy and Americans with Disabilities Act requirements.