EXHIBIT_4_-_ISS_-_Enterprise_Security_Standards_-_External_Data_Hosting.pdf

PDF 162 KB Posted Nov 18, 2022

Attached to: Inmate Commissary and Banking Services
Solicitation number: Y22-120
Issued by: Orange County, Orlando City, Florida

About this file

Written by GovTribe AI · Jun 27, 2025

The document is an Enterprise Security Standards policy for External Data Hosting, specifically developed by Orange County Government Board of County Commissioners (OCGBCC). The policy establishes comprehensive standards for the retrieval, storage, transmission, processing, and handling of electronic data by vendors, networks, systems, and applications. It provides detailed guidelines on data input, processing, storage, transmission, and disposal, with a strong emphasis on protecting sensitive information such as social security numbers, bank information, usernames, passwords, and other personally identifiable data.

The policy mandates stringent security measures, including field-level encryption for specific data types, transmission within encrypted tunnels, and strict protocols for data disposal through sanitization, destruction, or purging. Vendors must ensure their web hosting environment and applications are secured using information security best practices and must either pass an annual penetration test conducted by Orange County ISS personnel or provide results from an external audit by a reputable third-party security company. The document includes revision history noting updates in October 2017 and August 2012, which expanded definitions, added encryption specifications, and included options for third-party vendor audits.

View the file

Other files

File	Type	Posted
Inmate_Commissary_and_Banking_Services_(Addendum_#9_Revision).pdf	PDF	Mar 28, 2023
EXHIBIT_5-_Orange_County_IT_Standards_Aug_2021.pdf	PDF	Nov 18, 2022
EXHIBIT_3_-_EnterpriseSecurityStandards-InternalApplications.pdf	PDF	Nov 18, 2022
Y22-120_Inmate_Commissary_and_Banking_Services.pdf	PDF	Nov 18, 2022

On GovTribe

Work with this file

Download the original file
Contacts named in this file
Similar government files
Ask GovTribe AI about this file

Try for free Login

Text version

The file's text, extracted by GovTribe without its formatting.

EXTERNAL DATA HOSTING STANDARD

1.0 Purpose

The

purpose

this

policy

establish

standard

order

execute

the

proper

retrieval,

storage,

transmission,

processing,

and

handling

electronic

data.

2.0 Scope

This

document

applies

all

vendors,

networks,

systems,

and

applications

that

will

transmit,

process,

store,

handle

electronic

data

provided

Orange

County

Government

Board

County

Commissioners

(OCGBCC).

3.0 Audience

This

document

intended

for

distribution

those

that

are

involved

the

retrieval,

storage,

transmission,

processing,

and

handling

electronic

data.

4.0 Policies

4.1 Data Input and Processing

4.1.1 Any

use

Social

Security

Number

information

shall

adhere

and

abide

Florida

Statutes,

specifically

F.S.

119.071.

4.1.2 The

hosted

application

shall

not

have

access

social

security

information.

4.1.3 The

hosted

application

shall

not

have

access

data

containing

bank

information.

4.1.4 The

hosted

application

shall

not

granted

direct

indirect

access

OCGBCC

Active

Directory

usernames.

4.1.5 The

hosted

application

shall

not

have

access

the

OCGCC

internal

DMZ

networks.

4.2 Data

Storage

and

Handling

4.2.1 Any

data

accessible

from

the

hosted

application

meeting

the

following

criteria

shall

encrypted	at	a	field-level	and	in	transit:	usernames,	passwords,	names,	addresses,
phone	numbers,	email	addresses,	birthdates,	federal/state/local	document	numbers,
account	numbers,	race	or	religious	information,	usernames,	passwords,	employee
identification	numbers	and	all	HIPAA	and	PCI	information.

4.2.2 Any

data

accessible

from

the

hosted

application

directly

accessible

from

should

encrypted

field

level.

4.3 Transmission	of	Data
4.3.1 Any	data	referenced	above	shall	be	transmitted	within	an	encrypted	tunnel.

4.4 Disposal

Data

Once

data

longer

needed

must

removed

from

the

system

shall

sanitized

and

disposed

using

one

the

methods

below:

4.4.1 Sanitization

Overwriting

data

previously

stored

disk

drive

with

random

pattern

meaningless

information.

4.4.2 Destruction

Physically

damaging

medium

that

not

usable

any

device

that

may

normally

used

read

information

the

media

such

computer,

tape

reader,

audio

video

player.

4.4.3 Purging

data

Using

strong

magnetic

devices;

such

degausser,

possible

render

data

unrecoverable.

4.5 External

Audit

4.5.1 The

vendor

must

ensure

that

the

web

hosting

environment

and

the

application

secured	using	information	security	best	practices.
4.5.2 The	external	service,	system,	and	application	must	pass	a	yearly	penetration	test

performed

Orange

County

ISS

personnel.

Alternatively

the

vendor

can

provide

the

results

external

audit

conducted

reputable

3rd

party

security

company.

5.0 Definitions

Term		Definition
Bank	Information	Checking	account	numbers,	credit	card	numbers,	or	any	unique	number

from

bank

institution.

Electronic

Media

Physical

objects

which

data

can

stored,

such

hard

drives,

zip

drives,

CD-ROMs,

DVDs,

USB

drives,

and

tapes.

Sanitization

expunge

data

from

storage

media

that

data

recovery

impossible.

Physical

Destruction

sanitization

method

for

optical

media,

such

CDs.

Florida

Statue

119.071

Detailed

guidelines

usage

Social

Security

information

EXHIBIT 4

ENTERPRISE SECURITY STANDARDS, POLICIES, AND GUIDELINES

6.0 Revision History

October	2017 Specified	“field-level	encryption”	for	sensitive	data	at	rest	in	4.2.1
Added	usernames	and	passwords	to	the	list	in	4.2.1
Added	an	option	for	a	3rd	party	vendor	in	4.5.2
Added	definition	for	field-level	encryption

August 2012 Added “Bank Information” to list of definitions in 5.0

File details come from the government source that posted it. Updated Jun 27, 2025.