Attachment_D_-Enterprise_Security_Standards_-_External_Data_Hosting_Rev3.pdf

This is an Enterprise Security Standards policy document for Orange County, Florida Government Board of County Commissioners (OCGBCC) establishing mandatory security requirements for external data hosting vendors and applications. The policy applies to all vendors, networks, systems, and applications that transmit, process, store, or handle electronic data for the County and establishes standards for data input, processing, storage, handling, transmission, and disposal. The scope encompasses retrieval, storage, transmission, processing, and handling of all electronic data provided by OCGBCC, with particular emphasis on protecting sensitive information including Social Security numbers, bank information, Active Directory credentials, and health-related and payment card data.

The policy mandates comprehensive security controls requiring that hosted applications prohibit access to Social Security numbers, bank information, Active Directory usernames, and internal network resources. All sensitive data including names, addresses, phone numbers, email addresses, birthdates, federal/state/local document numbers, account numbers, and HIPAA/PCI information must be encrypted at the field-level both at rest and in transit through encrypted tunnels. Vendors must ensure data disposal through sanitization, physical destruction, or purging using approved methods when data is no longer required. External security validation is mandatory, requiring vendors to pass annual penetration testing conducted by Orange County Information Security Services personnel or provide results from a reputable third-party security company demonstrating compliance with information security best practices. The policy was last revised in October 2017 with clarifications regarding field-level encryption requirements and third-party audit options.