Fiber_Optic_Install_Repair_G_H.pdf

PART G

SPECIAL PROVISIONS

Work consists of the maintenance, construction, and repair of the Intelligent Transportation System (ITS) for Orange County. The work includes the repair and installation of fiber optic cable and ITS components found at traffic signal locations, master communication huts, and their connections to the Traffic Management Center

(TMC).

The installation and repair of the ITS communication network infrastructure includes, but is not limited to:

• Installation of fiber optic cable and related connections and infrastructure

• Fiber testing and investigation and repair of outages

• Troubleshooting of the communication network

• Installation and configuration of I.T.S. communication huts

• Installation and configuration of vehicle detection system

• Installation and configuration of high-resolution Closed-Circuit

Television (C.C.T.V.) camera systems

• Installation and configuration of Bluetooth travel time systems

INFORMATION TECHNOLOGY PROVISIONS

The CONTRACTOR shall comply with Orange County IT Standards (attached as appendix) and Security standards.

Prohibited Hardware

Personal (non-County) computing equipment Any network device not operated, administered, or expressly approved by ISS Any internet access device not operated, administered, or expressly approved by

ISS

Donated and vendor-provided PCs that do not meet County standards

Network Security & Connectivity

Connections of any contractor from the internet to the County's network must be done by individual VPN accounts using Okta's MFA and Cisco AnyConnect VPN Client.

Connection of any contractor and/or their equipment to the County’s network or any subsystem requires prior approval from ISS. The request must include the dates, times, duration of connection, and the reasons for the connectivity. The requestor must be ready to provide the technical device, any available documentation, and technical contacts to ISS.

No INTERNET connections are allowed from any node, modem, or communications device on the network without NOC and Enterprise Security approval.

Contractor is prohibited from using unapproved wireless devices to access the county’s network devices. Attaching any wireless devices into county’s network hardware is strictly prohibited.

Contractor access to the Traffic Server Room must be coordinated in advance, authorized and under the supervision of ISS personnel.

Authorized Use

Contractor shall use authorized County Traffic network computer (laptop) provided to them when working in the Traffic shop, as well as in the field directly at the traffic signal cabinets as needed.

This computer system is owned by Orange County and shall be returned to TMC on a weekly scheduled basis (Friday mornings) to receive Windows updates, Antivirus updates, computer configuration changes via Active Directory policies, and any updates as deemed necessary.

Access and use shall be for official county business by authorized personnel.

Unauthorized access or use may subject violators to criminal, civil or, administrative action. Any information on or accessed via this computer system, may be read, monitored, copied and disclosed to authorized personnel for any, purpose, including criminal investigations.

TMC Server Room access - Contractor access to the Traffic Server Room must be coordinated in advance, authorized and under the supervision of ISS personnel.

GENERAL PROVISIONS

1. All work under this contract shall be performed as directed by the Traffic Engineering Division of Orange County’s Public Works Department.

2. The Contractor shall be responsible for maintenance of traffic while working on or near roadways, and shall submit maintenance of traffic plans to the County for approval. Maintenance of traffic plans shall conform to the requirements of the Manual on Uniform Traffic Control Devices and the Florida Department of Transportation’s Design Standards, Index 600 series. Lane closures will not be allowed during peak traffic periods. Payment for maintenance of traffic shall be included in the unit cost of each pay item, and will not be paid separately.

3. The Contractor shall provide a representative to review a major project in the field with a County representative to determine what work will be needed and what pay items from the contract shall be included in the Delivery Order. Minor projects may not require field review as determined by the County representative.

4. The Contractor shall provide evidence of qualified personnel, including as a minimum, one International Municipal Signal Association (I.M.S.A.) Certified Level II Traffic Signal Technician, with a minimum of two years of experience in traffic signal maintenance. Only I.M.S.A. Certified Level II Traffic Signal Technicians or personnel under the direct supervision of an I.M.S.A. Level II Traffic Signal Technician shall perform work on any components within the traffic control cabinet.

5. The Contractor must present sufficient evidence that it is a Florida Department of

Transportation pre-qualified Contractor in the work classes of Computerized Traffic Control, Intelligent Transportation Systems, and Traffic Signal. The Contractor must maintain this pre- qualification throughout the term of the Contract.

6. No work shall begin until a Delivery Order has been issued to the Contractor. The

Delivery Order will contain a start date and completion date for each project released under this contract.

7. Urgent Work: Urgent work, as determined by the County's Representative, shall take place between the hours of 7:15 AM and 3:45 PM Monday through Friday. In the event of urgency, as declared by the County's Representative, the Contractor's Representative when requested shall be on site within one (1) hour of notification and have the equipment and personnel on site within two (2) hours after receiving the initial notification from the County. The Contractor shall coordinate and work closely with the County's Representative, maintaining open communication, until the project is complete. Upon agreement of the scope of services, a written estimate shall be signed, dated by both parties on site. The Contractor's Representative shall immediately forward the signed document (same day, regardless of the time) for the issuance of the delivery order.

8. Emergency Work: Emergency work, as determined by the County's

Representative, shall take place between the hours of 3:46 P.M. and 7:14 AM.

Monday through Friday or twenty four (24) hours on Saturdays, Sundays or County holidays. The County's Representative shall identify and authorize an emergency. In the event of an emergency, as declared by the County's Representative, the Contractor representative when requested shall be working on site within one (1) hour of notification, prepared upon arrival to perform work and have all required equipment and personnel on site within two (2) hours after receiving the initial notification from the County for an emergency call out. The Contractor shall coordinate and work closely with the County's Representative, maintaining open communication until the project is complete. Upon agreement of the scope of services, a written estimate shall be signed, dated by both parties on site. The Contractor's Representative shall immediately forward the signed document (same day, regardless of the time) for the issuance of the delivery order.

9. The Contractor shall designate a supervisor to coordinate work with County staff.

In the event of an emergency or an emergency event such as a pole knockdown or natural disaster, the Contractor shall be capable of responding with a repair crew within four hours. When contacted by the Project Manager about a suspected fiber outage, the Contractor shall have one hour to respond by telephone or email with acknowledgement of notification of suspected outage and explain what steps will be taken to rectify the outage. The Contractor shall begin to prepare materials and equipment to perform all tests necessary to determine the location of the outage. This includes troubleshooting patch panels, patch cables, splice enclosures, splice trays, splices, snow-shoes, optics, terminations (pigtails or buffer tubes fan out kits), and any such items as it relates to the I.T.S. Network.

Once the cause of the outage is determined, the Contractor shall determine a fix and propose it to the Project Manager.

Outages determined through troubleshooting by the Contractor or by Orange County I.T.S. personnel that result in more than one local hut to be out shall be repaired via Emergency Response. Upon notification or recognition of an outage requiring an Emergency Response, the Contractor shall respond to the site with the required equipment to repair the facility within two hours unless otherwise directed by the Project Manager. The notification not to respond within the required four hours must be received via email or phone. Once onsite, the Contractor shall show continuous pursuit of effort to complete the repair. The Contractor shall take corrective actions to have the system fully operational before leaving the site. If the Contractor determines and the County agrees that this type of failure will require additional time and/or equipment, then the Contractor will provide an estimate of the man-hours and materials costs required to complete the work and gain approval of the Project Manager prior to commencing any repairs.

Any materials and equipment furnished by the Contractor shall be equal to or better in quality than that being replaced and shall be approved by the Project Manager prior to purchase by the Contractor.

The County will make payment for services provided for Emergency Maintenance per work upon acceptance of the work and the invoice. The payment to the Contractor will reflect the actual hours and materials as documented by invoice and as approved by the County.

10. All verbal/written orders for urgent work issued by the County's Representative shall be followed by a written delivery order within seven (7) days after notification. Change orders shall be processed accordingly if warranted.

11. The Contractor will supervise and direct the work efficiently with due care, skill and attendance. The Contractor will be responsible to ensure that the finished work complies accurately with the specifications.

12. The Contractor shall furnish necessary equipment to satisfactorily perform the work required under this contract. The Contractor shall ensure all equipment used in the performance of the contract on County property is in good safe working order and properly maintained in order to protect the operator and the public.

The Contractor shall maintain at least one vehicle at all times capable of performing aerial I.T.S. work above thirty-five feet (35'). The vehicle and its safety equipment shall be maintained in safe, working condition and in accordance with the user manual. The County reserves the right to inspect the vehicle and equipment at any time with respect to compliance with this Contract.

The Contractor is required to use amber or amber/clear flashing lights, back-up alarms, etc. on all equipment and his/her employees must be provided with the required Personnel Protective Equipment as required by O.S.H.A. and the County.

Equipment authorized by the County to be left on the right-of-way or County property after designated work hours will be placed outside the clear and recovery area and will be the sole responsibility of the Contractor. If equipment is left on the right-of-way, it will be marked with barricades with approved steady burning amber lights.

13. The Contractor shall be responsible for and make good all damage resulting from his/her activities, both within and beyond the limits of this contract, to buildings, telephone, power or other cables, water pipes, storm sever facilities, sanitary pipes, gas lines, traffic signalization, or other utilities or structures which may be encountered, whether or not shown on the plans. It shall be the Contractor's responsibility to determine the location, character and depth of any existing utilities and to assist the utility companies, by every means possible, to determine said locations. Extreme caution shall be exercised to eliminate any possibility of any damage to utilities resulting from Contractor's activities.

The Contactor will be responsible for locates of utilities prior to starting operations. Tickets shall be kept on site at all times. The Contractor shall notify residents of any damages (irrigation, utilities, etc.) and shall repair damages immediately. No additional compensation shall be provided to the Contractor for locates or repairs to damages as specified above.

14. Quantities listed herein are estimates only and are not purchased by this Contract.

The Contractor shall have adequate resources to handle two or more Projects at the same time. The Contractor shall define and submit a Management Plan and Resource List containing the minimum components (including personnel and equipment) to describe in detail their capability to handle multiple concurrent projects. The multiple concurrent project capability is considered a minimum requirement of this Contract. All work will be ordered by the County's Representative in the form of Delivery Orders on an as needed basis.

15. Any products utilized must be listed in the current F.D.O.T. “Approved Product

List” if the specific device category exists. All materials and installations shall be in accordance with the latest edition of all applicable technical specifications including, but not limited to, the following: Florida Department of Transportation:

Standard Specifications for Road and Bridge Construction Standard Plans for Road and Bridge Construction Manual on Uniform Minimum Standards for Design, Construction and Maintenance of Streets and Highways Manual on Uniform Traffic Control Devices (MUTCD)

16. The Contractor will regularly keep the work site free from accumulations of waste materials, rubbish and debris from and about the work site as well as all tools, construction equipment and machinery, and surplus materials, and will leave the site clean, safe, and ready for occupancy by the County. The Contractor will restore to their original condition those portions of the work site, such as staging and stockpile areas, not designated for alteration by the Contract Documents.

This will include returning the area to the proper grade and slope as well as replacing sod, etc.

17. The County's Representative will be entitled at all times to be advised, at his/her request, as to the status and details of the work being completed by the Contractor in a format he/she requires. The Contractor will maintain coordination with the County's Representative at all times. The Contractor will inform the County's Representative monthly as to the locations to be worked and the areas completed the previous month. This update can be submitted via e-mail.

APPENDIX

Orange County, Florida, Information Technology Standards

8/10/2022

OrangeCounty, Florida, InformationTechnology Standards

Table of Contents

1.0 Introduction to Orange CountyIT Standards

2.0 Authorized Products for New Purchases

2.1 Authorized Hardware

2.2 Authorized Software for Desktopsand Laptops

2.3 Authorized Network Connectivity

2.4 Authorized Client Based Databases

2.5 Authorized Mobile Devices

2.6 Authorized Peripherals and Accessories

3.0 Unsupported Products

3.1 Unsupported Hardware

3.2 Unsupported Software

3.3 Unsupported Client Databases

3.4 Unsupported Peripherals and Accessories

4.0 Prohibited Products

4.1 Prohibited Hardware

4.2 Prohibited Software

4.3 Prohibited Network Protocols

4.4 Prohibited Peripherals and Accessories

5.0 Standards for In-House Servers and Server Operating Systems

5.1 MicrosoftWindows-Based Server Requirements

5.2 Linux-Based Server Requirements

5.3 Oracle-Based Server Requirements

5.4 Microsoft SQL-Based Server Requirements

6.0 Network Systems Requirements

6.1 Protocol Node Names and Addresses

6.2 Bridges, Routers, and Gateways

6.3 Network Security

6.4 Network Components

6.5 Network Circuits

6.6 Network Installation

6.7 Network Trouble Reporting

6.8 Network Performance Management

6.9 Network Documentation

7.0 IP Telephony Standards

7.1 Telecom Connectivityand Applications

7.2 Unwanted Calls

8.0 Externally-Hosted System Standards

8.1 Data Input and Processing

8.2 Data Storage and Handling

8.3 Transmission of Data

8.4 Disposal of Data

8.5 External Audits

9.0 Data Center Standards

10.0 Acronyms

ii

1.0 Introduction to Orange County IT Standards

This guide provides aframework fordocumentingpolicies, businessprocesses, andinternal controls usedto effectively support theinformation technology(IT) resourcesof thegovernmentof OrangeCounty, Florida, Board of County Commissioners (County). It explains the role of the County’s Information Systems and Services (ISS) personnel in approving, ordering, delivering, and maintaining IT services and products (hardware, software, networks, security,andotherIT components) foremployees throughouttheCounty. It identifies County-approved productsandprocedures foracquiringIT systems andservices.Thisguide also establishes County IT standards for use by third-party vendors providing externally hosted systems to various Countydepartments.

The goal of ISS is to build an efficient, effective, and cost-efficient operation with an excellent return on investment by delivering new technologies and a state-of-the-art network server infrastructure. ISS is dedicatedto providingprompt problemresolutionthroughthecustomerservice of its Help Desk. ISSseeks to maintain a diverse computing environment designed to meet the requirements of all County departments, while minimizing therisk of dataloss ordowntime.All computerhardwareand software must be approved by ISS prior topurchase.

The ISS Department is comprised of 160+ employees, who arecommitted to its customer relationship-buildingattitude. ISS provides abusiness approach to servingall County agencies,which togetherforma partnership with ISS personnel to enhance productivity and service to the community.

The following standards apply to any device approved forconnection to the County IT network orin useby County employees:

ISS personnel areresponsiblefororderingall new computers, software, servers, telephones, and mobile devices for use by County employees. Hardware and software orders arrive at the ISS Warehouse at 3517 Parkway Center Court, Orlando, FL 32808.

2 Submit orders by opening a ticket to request the new equipmentorsoftwareusing the ISS Support Center’s SupportCenter@ocfl.netemail address. All purchase requests requireapproval intwo forms.

Initial request approval is by the customer’s manageras indicated in the Peoplesoft “Reports To” field. Updates andChanges should be submitted through an ECNto HR. Thesecondary approval must come from a divisional representative with purchasing limit approvals. The emails will include pertinent informationabouttherequesteditem(s). If sufficient detailsarenot includedin theinitial email request, ISS staff will reach out to gather necessary information for the order. A list of authorized new products forpurchase begins on the following page.

ISS Warehousepersonnel areresponsibleforcoordinatingwith theComptroller’sOfficestaff to apply County asset inventory tags on computer components, as necessary, prior to installationof theequipment. Noone but the Comptrollers staffcan add orremove asset tags.

ISS Support personnel will install all operatingsystemsand software. At thetime of installation, ISS Support personnel must receive a copy of all installation software, along with written installationinstructions, andlicensingdocumentation.ISS will not install software without proof of licensing.

All installed computers must, at a minimum, have the following:

o ISS-installed anti-virus software o Computerconfiguration policycontrol forgroupmanagementof devicesby Active Directory o Remoteaccess only as designated by ISS(ISSprohibits theuseof Virtual Network Computing

[VNC] and Remote Desktop computing.)

o ISS-approved remote monitoring and management tools o Only ISSpersonnel shall have administrative rights.

o Hardware must be a standard supported model

ISS Enterprise Security is responsibleforISSvideo service; however, deploymentof video equipment on the local government network must be discussedwith staff membersof the Data Network Team prior to purchase to determine compatibility, bandwidth, network equipment requirements, and installation feasibility.

P a g e | 1

Generally, ISSdoes not support multicaston theCounty networks, exceptin specific special cases.

2.0 Authorized Products for New Purchases

This section includes detailed information about products authorized for use with the County’s IT Systems.

2.1 Authorized Hardware

Intel Core i5 Processor Windows 10 Professional 64-bit 256 GB Solid State Drive (SSD) Hard Drive 8 GB Random Access Memory (RAM) USB Keyboard andMouse Display Port to DVI Adapter6’ Cable 3-Year Onsite Hardwarewarranty

Intel Core i7-12700 Processor Windows 10 Professional 64-bit

32GB RAM

512GB SSD Hard Drive NVIDIA Quadro P1000 4GB, (4m DP) Video DVD RW OpticalDrive USB Keyboard andMouse 3-year Onsite Hardwarewarranty StarTech Mini DP to DP 1.2 4k 6’ Cable (Included separately)

Intel Core i5 -1235U Windows 10 Professional 64-bit 14.0" FHD (1920 x 1080) Non-Touch Anti-Glare LCD i5-1235U Trans, Integrated Intel Iris Xe Graphics, Thunderbolt, 8GB 512 GB SSD HardDrive 16 GB RAM (16GB Optional) Internal Aircard (Optional) NO DVD-ROM Drive HD & IR Camera w/Microphone 3-Year Absolute ResilienceProtection 3-Years Onsite Hardwarewarranty Optional Accessories(must be explicitly requested) o Dell WD19TBDocking Station o Dell KM717 Premier Wireless Keyboard/Mouse Set o Pro Briefcase 15 Carrying Case

P a g e | 2

OrangeCounty, Florida, Information Technology Standards o Backpack Case

P a g e | 3

Intel Core i7 Windows 10 Professional 64-bit 17.3" IPS (1920 x 1080) Non-Touch Anti-Glare LCD 1 TB SSD HardDrive

64 GB RAM

Internal Aircard (Optional) Nvidia RTX A5000 w/16GB RAM NO DVD-ROM Drive LCD RGB & IR Camera w/Microphone 3-Year Absolute ResilienceProtection 3-Years Onsite Hardwarewarranty Optional Accessories (must be explicitly requested) o Dell Performance Dock – WD19DCS– CDW #: 6416319 o Dell KM717 Premier Wireless Keyboard/Mouse Set - CDW # 6081940 o OGIO Gambit - Laptop carrying backpack - 17-inch – black - CDW # 3048862

P a g e | 4

2.2 Authorized Software for Desktops and Laptops

Microsoft Windows10 Pro Operating System current version or 1 version prior

Internet Explorer11 (deprecated), EdgeandGoogleChrome (Note: Browsercustomizations are unsupported)

Microsoft Office 2019 Pro Plus or Microsoft Office 365 G1/G3, currentversion or 1 version prior

All MicrosoftOffice applications on thesame PCmust have matchingsoftware versions(i.e., Project, Visio, Word, Power Point, Access, etc.).

Microsoft Visio2019 Pro/Standard Microsoft Office Pro Plus, current version or 1 version prior Microsoft Project 2019 Pro/Standard current version or 1 version prior Microsoft Visual Studio 2019 Pro currentversion or 1 version prior ISS Desktop Supportmust pre-approve any application requiringtheuse of Active Xcontrols. At a minimum, theapplication must meet the following criteria:

o It must be an .MSI file with silentinstallation/distribution from the command line.

o It must install and operate withoutend-user administrator permissions.

Java 1.8.25 – Only supported version of Java Silverlight – latest version Bomgar or WebEx forremote access Adobe Acrobat Pro 2020, current version or 1 version prior.

o Please note that older versions may not be able to view newer version files.

Check compatibility beforeordering.

Adobe Acrobat Reader DC.

2.3 Authorized NetworkConnectivity

AT&T WirelessAir Cards Cisco AnyConnect VPN Client Hostedapplications mustbeaccessiblefromdeviceswithautomatically assigned network settings. (DynamicHostConfiguration Protocol(DHCP)shouldsupply all settings. Fixed addresses are not allowed.)

For all devices joined to our domain (this also applies to “vendor supported” devices and applications):

ISS must install theOperating System and softwareonthe device.

ISS must receive a copy of all software and installation instructions.

Hardware must be a standard supported model (seealso hardware section 2.1).

SCCM management clientand Antivirus software must be installed.

PGP is required onall laptops.

Thedevice must receive Windows updates andcomputerconfiguration changes via

Active Directory policies.

Only ISSpersonnel shall have administrative rights.

VNCand Remote Desktop are not permitted.

2.4 Authorized Client Based Databases

Oracle (network based database) SQL Server (network based database)

P a g e | 5

2.5 Authorized MobileDevices

ISS personnel are responsible for placing orders for all new phones and mobile devices. Individual departments may purchase chargers, holsters, ruggedcases, and otheraccessories, alongwith otheroffice supplies. Department manager approval is required forall mobile devicerequests.

Conventional Phones Legacy phone with data & texting disabled

Kyocera DuraXEEpic

Android Phones County Android phones must run Android Version 9.0 or above.

Samsung Galaxy S22 (AT&T ) Samsung Galaxy S20FE(Verizon)

Tablets

Tab S7FE 64GB (Wi-Fi Only) Android Tab S7FE 64GB (Wi-Fi & Cellular Capable AT&T)Android iPad 9th Gen 64GB (Wi-Fi Only)iOS iPad 9th Gen 64GB (Wi-Fi & Cellular Capable) iOS

P a g e | 6

2.6 Authorized Peripheralsand Accessories

Black and White LaserJet Printers HP LaserJet Pro 404n (500 to 2,000 pages per month) < 4 users HP LaserJet M506dn or M507dn (5-10 people, 1,500 to 5,000 pages per month + secure printing) HP LaserJet M608dn(10-25 people, 5,000 to 16,000 pages/month + secure printing)

Color LaserJet Printers HP Color LaserJet Pro M454 (750-4,000 pages per month, small paper tray)

HP Color Laserjet Enterprise M652dn(2,500 to 17,000 pages/month + secure printing)

HP Multi‐Function Devices (MFD) (Print/Scan/Copy) HP MFPM428fdn(750 to 4,000 pages per month, B/W) HP color MFPM281fdw (1 or 2 people, occasional scanning) HP color MFPM479fdn(750 to 4,000 pages per month) HP color MFPM578dn(2,000 to 7,500 pages per month)

Specialty Printers

Label Printers: Zebra

Badge Printers: Fargo Model HDP6600

Large Copiers (Full Sized, often leased) – Vendor Supported Toshiba Copiers

Canon Copiers

Scanners (all come with Adobe Acrobat and Automatic Document Feeders [ADF]) Fujitsu ScanSnap iX1600 (30 pages per minute [ppm], 50 sheet ADF, Connected via USB) Fujitsu fi-7160 (60 ppm-mono and color, 80 sheet ADF, Connected via USB Fujitsu N7100 (25ppm, 50 sheet ADF, Networked)

Note: Printers must use Original Equipment Manufacturer (OEM) toner cartridges only.

P a g e | 7

3.0 Unsupported Products

3.1 Unsupported Hardware

Pentium dual-coreand older desktopsystems, Optiplex 755, 960, 990, 9010 Latitude D-series Laptops, Latitude E6500, E6510, E6520, E6530, E65xx Non-Dell PCs Wireless keyboards and mice (except conference rooms) Desktops and Laptops over 5 years old

See also Section3.4, Peripherals and Accessories.

3.2 Unsupported Software

MSOffice platforms 2 versions prior to current(including Visio & Project) Non MS Windows-based operating systems

Safari Web Browser MSOffice plug-ins or VBScripts Windows Applications from the Windows App Store Freeware Microsoft Windows7, XP, 98, 95 and 3.5.1 areno longer Orange County Standard (No new applications can be purchased for Win 7 computers) Freelance SHL Vision & Vision Express, WIN9x/WINNT/UNIX Reflections Chrome extensions

3.3 Unsupported ClientDatabases

No client-based databases aresupported (e.g., Microsoft Access, FilemakerPro)

3.4 Unsupported Peripherals and Accessories

Inkjet printers Printers over 7 yearsold Scanning to multiple folders per device Address books in scanners/copiers(users manage their own) Personal (non-County) mass storagedevices(harddrives, thumb drives, etc.)

4.0 Prohibited Products

4.1 Prohibited Hardware

Non MS Windows-based PCs, laptops, and tablets Recycled, Remanufactured,and non-OEM toner Cartridges Refurbished PCs Personal (non-County) computingequipment Any network (voice ordata) devicenot operated, administered, orexpressly approved by ISS Any internet access device not operated, administered, or expressly approved by ISS Donated and vendor-provided PCs that do not meet County standards

P a g e | 8

4.2 Prohibited Software

Note: This list is not all inclusiveof prohibited software. If youhave questionsconcerning aspecific application, please open aticketorcontact the Desktop Support Supervisor.

Microsoft Internet Explorer version 10 and below

Serversoftware is not permitted onworkstations(SQLserver, print servers, web server, file sharing)

Cloud-based collaborativesoftware (data must be stored within our datacenter).

Personal Software (purchased fornon-commercial use) Firefox, Opera, Vivaldi Web Browsers

Any Alpha, Beta, Shareware, Trialwaresoftwarenotoperated, administered orexpressly approved by ISS and Purchasing.

Anti-virus products not operated oradministered by ISS Personal firewall products

Network scanningtools Remote access software other than that ISS explicitly authorizes Desktopsharing, remote control, orremote communications softwaresuch asRemote Desktop Web page editing tools (withoutprior approval) Software codingtools (withoutprior approval) Userinstalled screen savers Games Third PartyDesktops Disk Compression Non-Static BITMAP Backgrounds or screensavers iTunes or other content sharing applications

P2P software MSAccess Run-time Libraries Zoom installed Application (Web ok)

4.3 Prohibited NetworkProtocols

NETBUI

AppleTalk

Any network (voiceordata) softwareorservice not operated, administered or expressly approved by ISS.

Any Internet access service not operated, administered, orexpressly approved by ISS.

4.4 Prohibited Peripherals and Accessories

Portable music devices Webcams (exceptions with Manager approval) Printer sharing through aPC Wireless printing

P a g e | 9

5.0 Standards for In-House Servers and Server OperatingSystems The followingserver standards apply to all servers ontheOrange County network maintained by County ISS personnel:

Only ISSpersonnel shall have administrative rights to server-class devices.

All servers shall operate in a VMWare-based virtual environment. The ISS Infrastructure

Managermust approveinwriting any exceptionsto this ruleprior to projectimplementation.

Any devicethatcannotrunin aVMWare-based virtual environment(“stand-alone”)must have hardware and software approved by ISSInfrastructure Managerprior to its connection to the County network.

All servers will comply with ISS standard resource configurations. The ISS Infrastructure Managermust pre-approve any deviation from this standardand may incuradditional costs.

No server shall be configured as a ‘file share’. File storage shall be NAS based.

Inaddition to therequirements listedabove, all stand-alone devices must, at aminimum, meet the followingrequirements:

o Beinstalled at the County’s Regional Computing Center(RCC) o Berack-mountable o Only run server-class operatingsystems o Beconfigured forout-of-band management and have remotemonitoring software installed o Meet ISS minimum hardware requirements including, but not limited to:

▪ Dual powersupplies

▪ Dual NIC’s

▪ Dual processors

▪ Dual HBA’s

▪ Dual harddrives, redundantarray of independentdisks (RAID) configurable for boot drive

▪ Usestorage area network (SAN) for attached storage devices

The following lists thedefault standards used forspecific serveroperatingsystems:

5.1 Microsoft Windows-Based Server Requirements

In no caseshall anoperatingsystem be installedthatis not undercurrent manufacturersupport (typically this is N-2 for Microsoftoperating systems).

The Boot partition “C Drive” shall be 100 GB (Thin Provisioned).

The Data partitionshall be 40GB to 100 GB (Thin Provisioned).

8 GB RAMdefault The C: drive will containonly theoperatingsystems. Databases must resideonseparateservers from that of applicationor Web servers.

Application, service, or vendor accounts will not be members of thedomain administrator’s group.

Application, service, or vendor accounts will not be in thelocal administrator’s groupfor any server.

Applications mustrun as aservice. ISS prohibits applications thatrequire a useraccount to remain loggedin.

P a g e | 10

5.2 Linux-Based ServerRequirements

RHEL 7 orgreater, kernel 3.0 orgreater, 64 bit architecture Server names will be determined by the Linux team The vendorwill provide minimum hardwareand software requirements Graphic user interfacewill not be installed(headless servers only) 50 GB rootpartition Will utilize SAN storage exclusively

Root login must be disabled All servers must be joined to the OCFL.NET domain- all users will login using their AD credentials Local users will be created only forsystem and application processes Local users login will be disabled Configuration management will be donethrough Ansible Telnetmust be disabled

FTP and SFTP must be disabled Firewall should NOT be disabled SELinuxshouldNOTbe disabled All administrative tasks must be carried out via SSH All servers must be configured to be monitored by Solar Winds Applications will be installed using aunique user ID and unique group ID.

Purge applicationand system logs, as needed.

Newrequests for Linux servers should be reviewed and approved by the Linux Team Applications Willnot:

o Have a web interface that allows users to access the system as aprivileged account.

o Run root processes.

o Beinstalled in any file system that is part of root.

o Write logfiles to any file system that is part of root.

o Update root system’sfilesduring installation

5.3 Oracle-Based Server Requirements (Legacy Support)

County-supported Oracle versions are:Oracle Enterprise Edition currentversion or 1 version prior that is supported by Oracle.

County-supported environment for Oracle databases is RHELLinux.

Database setupshall be compliantwith Oracle’sOptimalFlexible Architecture(OFA) filenaming conventions Applications must be installedunderseparateschema not requiring Database Administrator

(DBA) privileges or DBA type privileges. Applications will not require or use the Linux Oracle account.

Applications will provide asecurity module to manage user IDs and permissions.

Applications shall supportOrangeCounty’sEncryptionpolicy’s whetherattablespaceor column level for Sensitive/Protected data without impacting performance.

Applicationvendors shall identify and document Sensitive/Protected data field/s as defined in Orange County Security Standards Policy.

Applicationvendors shall provideall databasecreationscripts andany otherrequired scripts to build, maintain, and support the database environment.

Applicationvendors shall provideall documentation related to all databasecreationscripts and

P a g e | 11 any other required scripts to build, maintain, and support the database environment.

ISS personnel shall install databases using vendorprovided scripts,initialization parameters, and any special performancerelated parameters.

Oracle’s Administrator(SYSADM)account must not be required forsoftware to operate.

NOTE: If SYSADM privileges are required for installation, a County Database Administrator shall perform the installation vendor supplied scripts under the application vendor’s direction.

5.4 Microsoft SQL-Based Server Requirements (Preferred Standard Database for current and future use) County-supported Microsoft SQLServerversions are:MSSQLServerEnterpriseEdition current version or 1 version prior that is supported by MS.

Database installations must be on a separate server from the application executables and supportfiles. Databaseinstallations cannotbe installedto theC:drive of theWindows Server.

Applications will allow theISSDatabase Administratortospecifythedrives anddirectories where the database files willreside.

MSDE, SQL Server Express, or MS Access based software areprohibited.

Applications must support SQL Servers Integrated Security model.

Applications shall supportOrangeCounty’sEncryptionpolicy’s weatherattablespace or column level for Sensitive/Protected data without impacting performance.

Applicationvendors shall identify and document Sensitive/Protected data field/s as defined in Orange County Security Standards Policy.

Applications must contain asecurity module to manage user ID’s and permissions, with no blank or hard-coded passwordsallowed.

Applications shall support a Cluster aware environment.

ISS prohibits use of applications thatcreate, update, ordelete of any files on thedatabase server outside the constructs of the database engine.

ISS prohibits use ofapplications thatcreatenew databases or persistentdatabaseobjects as part of its operation.

Applications shall supportapplicationdatabasebackups/restores usingtheCounty’s Enterprise Backup Tool. Currently,theCounty standard is CommVault’s Galaxy iData-Agentfor SQLServer.

Applications must provide anaudit mechanismto record thedate, time, and user id thatlast modified a given row in an application table.

Applications must utilize database referential integrity.

Server Administratorprivileges are not permitted.

NOTE: If ServerAdministratorprivileges arerequiredforinstallation, anISSDatabase Administratorshall perform the installation.

P a g e | 12

6.0 Network Systems Requirements

6.1 Protocol Node Names and Addresses

The ONLYprotocol allowed on theCounty Data Network is theInternetProtocol referred to as

Internet Protocol (IP) orTransmission Control Protocol/InternetProtocol (TCP/IP)Version4.

Therecan be only one unique address foreach node onthenetwork. Node naming and addressingconventions will conform to the guidelines established here.

The NOCassigns all addresses forall devices connecting to theCounty Network. All IP addresses must conform to R.F.C. 1918:

10.0.0.0 - 10.255.255.255/8

172.16.0.0 - 172.31.255.255/12

192.168.0.0 - 192.168.255.255/16

The NOC maintains an addressing plan and uses the plan to assign addresses. The Internet AddressingAuthority, aprivateentity,assignedablock of addresses fortheCounty. TheNOC will maintain and assign these addresses, as needed.

Use of Registered Internet addresses on the County network is not allowed.

All network numbers for “special function” TCP/IP networks will be assigned by theNOC.

No INTERNET connections areallowedfrom any node, modem,or communications deviceon the network without NOC and Enterprise Security approval.

A network-wide, shared-use Internet connectionis available to all entities.

TCP/IP DOMAIN NAME SERVERS (DNS) are an alternative to local administration and maintenance of a “hosts” file. AnyDivisions,Elected Officials, oragencies wishingto use theDNS may send a list of IP addresses to be included in the DNS to the ISS Support Center, (407-836- 2929 or 6-2929), which will be routed to the NOC staff.

Entities who have dedicated network staff andwish to be assigned theirown IP address space will request the assignment from theNOC through the ISS Support Center, (407-836-2929 or 6- 2929). These entities will provision their own DNS and be responsible foradministration of their own IP address spaces (as assigned by the NOC for the agency to administer).

Only routed networks with at least 254 IP nodes areeligibleforthis option. DHCPis provided by the NOC.

Noshared device (printer, server) may usea DHCP address.Static IPaddresses areavailable in limited amounts on request.

6.2 Bridges, Routers, and Gateways

Routers arerequired at points in thenetwork wheretraffic control and/orbroadcastdomain segmentation needsexist.

Routers are required on all Wide Area Network connections.

Protocol conversion is not supported onthis network,as one commonprotocol (TCP/IP) is standard for allnodes.

6.3 Network Security

All default accounts onall processors connected to thenetwork will eitherbe disabled or have

P a g e | 13 the default password changed. No accounts are allowed without passwords.

The default “privileged password” onall network electronicswill be changed.

All dial-up access mustbe providedthroughsecure access servers. No direct access viadial-up lines is allowed on any type of device, processor, terminal, server, or PC connected to the network.

The NOC provides and maintains a secure access server for Dial-up use. Contact the ISS SupportCenter (407-836-2929 or6-2929) forremote access authorization by theEnterprise Security Team.

The requestingdepartment will provide thehardware& softwarefor the employee’s home use, unless the employee provides their own.

Vendorfield service will haveremote access through NOCprovided access servers.VPN access is availablefor use.

No entity on the network shall make any connection to the Internet, dial-up service, wireless provider, or wireless access-pointwithoutwrittenpermissionfrom the ISS Enterprise Security Team and Network Operations.

An Internet gateway is provided forall entities on the network to use.

Any entity that directly connects their network to theInternetmay not remainconnected to the

County network, due to security risks. If the Internet connected entity supplies, at their own expense, an acceptable Firewall betweentheirnetworks and the County networks, theCounty network connectioncanresumevia the Firewall provided.

Wireless Local Area Network (LAN) (Ethernet) Security All 802.11x wireless LANs must usea DOT1X supplicant for network admission control.

All 802.11x clients mustuse VPN triple Data Encryption Standard(DES) or Advanced Encryption Standard (AES) encryption. Client authentication via RADIUS server is required. The RADIUS server is provided and administered by ISSEnterprise Security.

All access points attached to the County network must be Lightweight Access Point (LWAP).(No stand-alone access points are permitted)

Wireless Wide Area Network (WAN) Security The Countymaintains acontract with a wireless provider. Agateway is availableforconnecting to the contracted wireless provider. The County prohibits access to the network using any other wireless provider.

6.4 Network Components

Transmission Media

Fiber-optic, Category 5, 5e, and 6, and Category 3 Unshielded Twisted Pair(UTP), Shielded Twisted Pair (STP), and radio (802.11x) are all permitted for IP data communications in the network.

Transmission Methods Optical, metallic cable, leased data circuits (analog, digital), private (analog, digital), and wireless (802.11x) are all permitted for IP data communications in the network.

Supported LAN Types ETHERNET, 802.3,10 BASE T, 100 BASE TX, 100 BASE FX, 1000 BASE xx (Gigabit), 802.11x

(wireless Ethernet), 10GIGABIT.

Etherchannel:The only Etherchannel protocol supported by theCounty is 802.3ad

Link Aggregation Control Protocol (LACP).

6.5 Network Circuits

The NOCwill design all WAN networks and, if required, procureleaseddata communications circuits from theCarrier.

The NOC will act as the central point of contactbetweenall entities using WAN circuits.

P a g e | 14

The NOC will be notified by the affected entity and/orthe ISS Support Center of service affecting WANoutages.

The ISS Support Center (407-836-2929 or 6-2929) and the NOC will be responsible forcoordinatingsuccessful repair of WAN circuits.

The NOC will be responsible forordering thedisconnection and termination of leased data circuits upon notification by the customer.

Critical LANs and/orWANs maybe designed with duplicate, automatic, redundantcircuits and electronics to provide automatic recovery of data communications.

Circuits leased by any entity (otherthantheCounty) will be managed by that entity’s technical staff.

ARemoteSiteis available forrecovery of certaincriticalapplications and County networks in the event of aformally declared disaster.

6.6 Network Installation

In situations where installation of network equipment by one entity may affectcustomers from other entities, the installation will be jointly coordinated by representatives of the NOC and the other entities.

The NOCwill design and install all LAN and WAN networks, except in special circumstance.

6.7 Network TroubleReporting

Customers exclusivelyconfined to applications delivered by networks supplied by theNOC will call or e-mail the ISS Support Center (407-836-2929 or 6-2929) to report trouble, request service, and get technical advice. The ISS Support Center will screen all calls, resolve any problems it is able to resolve with ISS Support Center staff, and refer unresolved network problems to theNOC.

Customersexclusively confined toapplications onnetworks supplied byotherentities will call that entity’s network staff to reporttrouble, requestservice, and gettechnical advice.

Customers ona mix of processors and networks supplied by the NOC and other entity’s processors and networks will call the ISS Support Center (407-836-2929 or 6-2929) to report trouble, request service, and get technical advice.

The NOC employs a variety of network management and troubleshootingtools and systems. These network management systems are used by the NOC staff to test, troubleshoot, and diagnose all devices attached to the network.

All LAN equipment attached to thenetwork must support Simple Network ManagementProtocol (SNMP) and/orSNMP-2. RemoteMonitoring (RMON) is also allowed, but not instead of SNMP.

RMON is inaddition to SNMP. Olderequipmentnot supporting these standards will be phased out. The NOC is the only organization permitted to run SNMP on network equipment.

Network problems thatcan be repaired by theNOC will be scheduled ina repairqueue. Repair priority is based ontheseverity of the problem and quantity of customers affected.

All devices attached to the network must have at least a minimum SNMP profile entered, consistingof theentity’s name, address, andtechnical supportstaff phones number(s).This will assist NOC staff in locating the network on which the equipment is located, when troubleshooting.

6.8 Network PerformanceManagement

The NOC is responsible formonitoringall LAN and WAN performance. This includes all

SNMP and RMON.

Only NOC staff members areallowed to run SNMP/RMON on network devices.

The NOCwill redesignnetworks,which sustaintraffic loads that adversely affect customer interactive response times and/or reliability.

The NOC will assist other entities with managing the performanceof their networks as

P a g e | 15 requested.

6.9 Network Documentation

Each entity on the network will provide the NOCwithacurrentdiagram of network topology, equipment location, and configuration (includingbuildingaddress and floor location).

The NOC will provide adiagram of the network as well as tables and listings of all physical and logical components to any approved requesting entity.

Each entity on the network will provideon-going, updated information to the NOC reflecting components, circuits, and logical changes.

The NOCwill add this information to its diagram and database, and will provide the revised network documents to all requesting entities.

7.0 IP Telephony Standards

The definition of IP telephonyis telephones and a Private Branch Exchange (PBX) with an integral Ethernet Network Information Card (NIC) using the Internet Protocol to communicate.

7.1 Telecom Connectivity and Applications

All telecomrelatedapplications must be certified undertheAvayaDevConnect program and compatible with the County’s current level of Avaya Communications Manager for the appropriate site.

The Telecom Unit mustapprove all peripheral applications, orsoftware, prior to purchase.

IP phones must derive theirelectrical powerfrom theCAT-6/5e Ethernetcable. (POE type-1, 802.af standard) Ethernet switches in theclosets will be used to provide in-line DCpowerthrough theCAT-5e patch panels.

All Ethernet electronics used in this configurationwill havea UPS attached.

If the IP phone has aprovision to connect the desktop PCinto thesame Ethernet as the phone, then theIP phone must use Ethernet switch technology. Useof ahub/repeateris not allowed.

IP phones must operate in a separate subnet from the attached PC.

IP phone packets will be given the highest priority of all IP communications traffic on the

LAN. Other non-telephony applications will have their “IP Precedence” bit modified at the Ethernet switch to conform to this standard.

IP phone access to the network through the internet provider will use the ISS provided VPN services.

Direct access to internal devices is prohibited.

7.2 Unwanted Calls

Robocalls and SPAM - We have automated security systems which block callers listed in a national database of Robo dialers. Our systems also block repeat callers who exceed a threshold consistent with automated advertising systems. If you are getting unwanted solicitations from an automated system please email the ISS Service Center (supportcenter@ocfl.net) to report the issue. Provide the time and date of the call, thenumber calling, your 10-digit phone number, and what was heard on the call.

Harassing phone calls ‐ Please reportcalls thatare threatening in nature to the Orange County Sheriff's Office. They will want to know the time and date of the call, the number calling, your 10-digit phonenumber, and why thecall was harassingin nature.

Nuisance calls ‐ Ourmission is to serve thecitizens of Orange County and ouremployees with integrity, honesty, fairness and professionalism. We cannot block nuisance calls from upset citizens. In extreme cases, issuing a new phone number may be an option.

P a g e | 16

8.0 Externally-Hosted SystemStandards

This informationisforall…