ATTACHMENT_D-_Security_QUESTIONAIRE.pdf
PDF 170 KB Posted
- Attached to
- School Zone Speed Detection Safety Program
- Solicitation number
- Y26-131
- Issued by
- Orange County, Orlando City, Florida
About this file
Security Questionnaire Summary
This is a Security Questionnaire document from Orange County Government Board of County Commissioners (OCGBCC) intended to evaluate compliance of projects, products, or applications with enterprise security policies and procedures. The questionnaire applies to the School Zone Speed Detection Safety Program (RFP Y26-131) and requires respondents to provide comprehensive security documentation including contact information, scope details, and compliance certifications. Key submission elements include verification of HIPAA, PCI-DSS, CJIS, or other regulatory compliance; detailed network diagrams; and documentation of existing security certifications or waivers. The questionnaire mandates that solutions must be compatible with SAML-based Single Sign-On and multi-factor authentication, support encryption in transit and at rest, operate with current antivirus and security patches, utilize unique service domains, comply with least privilege principles, and maintain comprehensive audit logging. Non-mandatory pre-proposal conference is scheduled for March 2, 2026, with questions due by March 4, 2026, and sealed electronic proposals due by March 24, 2026 (later extended to April 16, 2026) via the OpenGov e-Procurement Platform.
The questionnaire requires vendors to demonstrate that their speed detection systems and associated software comply with all OCGBCC IT and security standards, including data encryption protocols, antivirus compatibility with Sophos Anti-Virus, Florida Public Records requirements, and annual cybersecurity penetration testing documentation. Respondents must either provide results from completed penetration tests conducted by reputable third-party security assessors or commit to undergoing such assessments. All sensitive information including emails, names, addresses, SSNs, driver's licenses, passwords, and ePHI must be excluded from the solution, and any internet-accessible resources must either eliminate the need for tunnels, VPNs, or reverse proxies, or be properly housed in a County-managed DMZ. The estimated contract budget is $31,464,000 with a firm fixed-fee structure for the 10-year term, and all data storage must be maintained on servers located within the continental United States in compliance with foreign ownership restrictions.
View the file
Other files
Show all 35
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Security Questionnaire Page 1 of 2
SECURITY QUESTIONAIRE
Please fill out this questionnaire that will aide in the determination if the following project, product, or application is compliant with the Orange County Government Board of County Commissioners (OCGBCC) enterprise security policies and procedures.
CONTACT INFO:
Project name: _____________________________________________________________________________________
ISS Project Leader: ________________________________________________________________________________
OCGBCC Business / Department: ___________________________________________________________________
Vendor Contact: ___________________________________________________________________________________
COMPLIANCE CHECKLIST:
Attach any relevant documentation / certification / existing waivers for compliance.
☐ Currently used OCGBCC solution ☐ Complies with OCGBCC IT & Security Standards
Check if the solution is subject to: ☐ HIPAA ☐ PCI-DSS ☐ CJIS ☐ Other: ____________________
SCOPE:
Please attach a detail of the scope for the project or application. Including the following information: County Workstations, Databases, Servers; Internet and DMZ usage; Application Data (include sensitivity), Mobile Applications, Browser Extensions, Service Accounts, APIs, SSL Certificates, People and Locations. This can include or be represented by a complete network diagram.
SURVEY QUESTIONS:
☐ Compatible with SAML based Single Sign On
(SSO), MFA and auto-provisioning ☐ Information is encrypted in transit and at rest
(using field-level encryption) ☐ Solution supports running with antivirus and all latest security patches with no exceptions ☐ Does not need a tunnel, VPN, or reverse proxy
☐ Service uses unique domains that are not shared with other businesses (such as ocfl.service.com)
☐ Does not contain any sensitive info (emails, names, addresses, SSNs, Driver’s Licenses, passwords, employee identification numbers, ePHI, Banking info, etc.)
☐ Generic accounts are not used and application conforms to least privilege principles.
☐ Will comply with all Florida Public Records requirements
☐ DMZ or County hosted internet accessible resources are needed
☐ Audit logs are generated for all actions and tasks and can be exported
Date and auditor of last Completed Cybersecurity penetration test: ______________________________________ Please attach the results (without NDA clause). If none have been completed, please include a statement for an assessment to be completed either by Orange County or from a reputable 3rd party security assessor.
Please provide any additional details about the survey questions above: _________________________________
Security Questionnaire Page 2 of 2
| Please fill out this questionnaire that will aide in the determination if the following project, product, or application is compliant with the Orange County Government Board of County Commissioners (OCGBCC) enterprise security policies and procedures. |
| CONTACT INFO: |
| COMPLIANCE CHECKLIST: |
| SCOPE: |
| SURVEY QUESTIONS: |
File details come from the government source that posted it. Updated .