ATTACHMENT_D-_Security_QUESTIONAIRE.pdf
PDF 170 KB Posted
- Attached to
- Intersection Automated Enforcement Safety System
- Solicitation number
- Y24-1099
- Issued by
- Orange County, Orlando City, Florida
About this file
This is a Security Questionnaire for the Orange County Government Board of County Commissioners (OCGBCC) related to the Intersection Automated Enforcement Safety System (RFP Y24-1099). The questionnaire is designed to assess vendor compliance with OCGBCC enterprise security policies and procedures for the proposed red light camera enforcement system. Vendors must complete the form and provide detailed documentation of their technical solution's security posture, including scope details covering county workstations, databases, servers, internet and DMZ usage, application data sensitivity levels, mobile applications, browser extensions, service accounts, APIs, and SSL certificates. The submission deadline for proposals is January 28, 2025, at 4:00 pm EST via the OpenGov e-Procurement Platform, with a non-mandatory virtual pre-proposal conference scheduled for December 3, 2024, at 3:00 pm. The contract is structured as a ten-year term with milestone reviews scheduled for the fourth and seventh years, with potential expansion to up to 120 red light cameras and a service start date of March 1, 2025.
The Security Questionnaire requires vendors to demonstrate compliance with multiple regulatory frameworks, including HIPAA, PCI-DSS, and CJIS standards. Vendors must confirm compatibility with SAML-based Single Sign-On (SSO), multi-factor authentication (MFA), and auto-provisioning capabilities; implement field-level encryption for data in transit and at rest; support antivirus software and security patches; utilize unique, non-shared domains; adhere to least privilege principles without generic accounts; comply with Florida Public Records requirements; and generate audit logs for all actions. Vendors must also provide documentation of completed cybersecurity penetration testing results from either Orange County or a reputable third-party security assessor. The estimated project budget is $29,491,152, with funding allocated through accounting line 1002-072-2718-3197. The procurement includes a 24% Minority/Women-Owned Business Enterprise (M/WBE) participation goal and prohibits vendors from being owned by or having controlling interests from foreign countries of concern as defined by Florida Statute 287.138(1).
View the file
Other files
Show all 21
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Security Questionnaire Page 1 of 2
SECURITY QUESTIONAIRE
Please fill out this questionnaire that will aide in the determination if the following project, product, or application is compliant with the Orange County Government Board of County Commissioners (OCGBCC) enterprise security policies and procedures.
CONTACT INFO:
Project name: _____________________________________________________________________________________
ISS Project Leader: ________________________________________________________________________________
OCGBCC Business / Department: ___________________________________________________________________
Vendor Contact: ___________________________________________________________________________________
COMPLIANCE CHECKLIST:
Attach any relevant documentation / certification / existing waivers for compliance.
☐ Currently used OCGBCC solution ☐ Complies with OCGBCC IT & Security Standards
Check if the solution is subject to: ☐ HIPAA ☐ PCI-DSS ☐ CJIS ☐ Other: ____________________
SCOPE:
Please attach a detail of the scope for the project or application. Including the following information: County Workstations, Databases, Servers; Internet and DMZ usage; Application Data (include sensitivity), Mobile Applications, Browser Extensions, Service Accounts, APIs, SSL Certificates, People and Locations. This can include or be represented by a complete network diagram.
SURVEY QUESTIONS:
☐ Compatible with SAML based Single Sign On
(SSO), MFA and auto-provisioning ☐ Information is encrypted in transit and at rest
(using field-level encryption) ☐ Solution supports running with antivirus and all latest security patches with no exceptions ☐ Does not need a tunnel, VPN, or reverse proxy
☐ Service uses unique domains that are not shared with other businesses (such as ocfl.service.com)
☐ Does not contain any sensitive info (emails, names, addresses, SSNs, Driver’s Licenses, passwords, employee identification numbers, ePHI, Banking info, etc.)
☐ Generic accounts are not used and application conforms to least privilege principles.
☐ Will comply with all Florida Public Records requirements
☐ DMZ or County hosted internet accessible resources are needed
☐ Audit logs are generated for all actions and tasks and can be exported
Date and auditor of last Completed Cybersecurity penetration test: ______________________________________ Please attach the results (without NDA clause). If none have been completed, please include a statement for an assessment to be completed either by Orange County or from a reputable 3rd party security assessor.
Please provide any additional details about the survey questions above: _________________________________
Security Questionnaire Page 2 of 2
| Please fill out this questionnaire that will aide in the determination if the following project, product, or application is compliant with the Orange County Government Board of County Commissioners (OCGBCC) enterprise security policies and procedures. |
| CONTACT INFO: |
| COMPLIANCE CHECKLIST: |
| SCOPE: |
| SURVEY QUESTIONS: |
File details come from the government source that posted it. Updated .