Attachment_E_-_Security_QUESTIONNAIRE.docx

This is a Security Questionnaire document for Orange County Government Board of County Commissioners (OCGBCC) related to the Corrections Jail Management System (RFP Y25-101-KS) procurement. The questionnaire is designed to assess vendor compliance with OCGBCC enterprise security policies and procedures for the ISS Project. Vendors must complete the comprehensive questionnaire to evaluate whether their proposed solution meets the County's security standards and regulatory requirements. A non-mandatory pre-bid meeting is scheduled for December 3, 2025, at 11:00 am, with questions due by December 10, 2025, at 5:00 pm EST. Sealed electronic responses must be submitted through the OpenGov e-Procurement Platform with multiple submission deadlines: January 8, 2026, March 5, 2026, and March 12, 2026, all at 4:00 pm EST. The contract term is five years with optional renewal options.

The questionnaire requires vendors to provide detailed scope documentation including county workstations, databases, servers, internet and DMZ usage, application data sensitivity levels, mobile applications, browser extensions, service accounts, APIs, and SSL certificates, ideally supported by complete network diagrams. Vendors must address compliance with HIPAA, PCI-DSS, and CJIS standards as applicable. Mandatory security requirements include SAML-based Single Sign-On compatibility, Multi-Factor Authentication, field-level encryption in transit and at rest, antivirus compatibility with latest security patches, unique non-shared domains, least privilege principle adherence, Florida Public Records compliance, audit log generation and exportability, and yearly cybersecurity penetration testing. Vendors must provide evidence of completed penetration tests or commit to assessment by Orange County or a reputable third-party security assessor. The questionnaire also addresses whether DMZ or County-hosted internet-accessible resources are required and mandates that solutions must not contain sensitive information such as emails, names, addresses, SSNs, or employee identification numbers.