Attachment_E_-_Security_QUESTIONNAIRE.docx

This is a Security Questionnaire document prepared by Orange County Government Board of County Commissioners (OCGBCC) for evaluation of the proposed Corrections Jail Management System (RFP Y25-101-KS). The questionnaire serves as a compliance assessment tool to determine whether the vendor's solution meets OCGBCC enterprise security policies and procedures. Vendors must complete detailed sections addressing project contact information, compliance checklist items, regulatory compliance requirements (HIPAA, PCI-DSS, CJIS), and a comprehensive scope description including county workstations, databases, servers, internet and DMZ usage, application data sensitivity levels, mobile applications, browser extensions, service accounts, APIs, SSL certificates, and network diagrams. The survey questions address critical security requirements including SAML-based Single Sign-On compatibility with multi-factor authentication, encryption in transit and at rest using field-level encryption, antivirus and security patch support, tunnel/VPN/reverse proxy requirements, unique domain usage, sensitive data handling, least privilege principles, Florida Public Records Act compliance, DMZ requirements, and comprehensive audit logging capabilities. Vendors must provide documentation of penetration testing results from the most recent cybersecurity assessment completed by Orange County or a reputable third-party security assessor, or commit to completing such an assessment if none has been conducted previously.

The questionnaire requires vendors to attach relevant documentation, certifications, and existing waivers demonstrating compliance with the specified security standards. This assessment tool directly supports the broader RFP evaluation process for a jail management system serving approximately 900 concurrent users with 5,175 facility beds. The security questionnaire must be completed and submitted alongside the vendor's response by the sealed bid deadline through the OpenGov e-Procurement Platform. Vendors must demonstrate capability to meet extensive security requirements including yearly penetration testing, field-level data encryption, antivirus protections, and compliance with FBI CJJIS Security Policy standards as mandated by Orange County's procurement requirements for this five-year contract with optional renewal provisions.