Attachment_E_-_Security_QUESTIONNAIRE.docx

This is a Security Questionnaire document for Orange County Government Board of County Commissioners (OCGBCC) related to the Corrections Jail Management System (RFP Y25-101-KS) procurement. The questionnaire is designed to assess vendor compliance with enterprise security policies and procedures for projects, products, or applications. Vendors must provide project contact information, confirm whether the solution is currently used by OCGBCC, verify compliance with OCGBCC IT and Security Standards, and identify if the solution is subject to regulatory requirements including HIPAA, PCI-DSS, and CJIS. The document requires vendors to attach detailed scope documentation including information about county workstations, databases, servers, internet and DMZ usage, application data sensitivity levels, mobile applications, browser extensions, service accounts, APIs, SSL certificates, and network diagrams. Vendors must also provide documentation of any relevant certifications, existing waivers, and compliance evidence.

The questionnaire contains ten mandatory survey questions addressing critical security requirements: SAML-based Single Sign On compatibility with multi-factor authentication and auto-provisioning; encryption of information in transit and at rest using field-level encryption; compatibility with antivirus and security patches; elimination of tunnel, VPN, or reverse proxy requirements; use of unique, non-shared service domains; absence of sensitive information in the system; implementation of least privilege principles without generic accounts; compliance with Florida Public Records requirements; DMZ or county-hosted internet-accessible resources; and generation of exportable audit logs for all actions and tasks. Vendors must provide documentation of cybersecurity penetration testing with dates and auditor information or submit statements committing to assessment completion by either Orange County or a reputable third-party security assessor. The questionnaire allows vendors to provide additional details clarifying responses to survey questions.