ISS_-_Enterprise_Security_Standards_-_External_Data_Hosting_Rev3.pdf

This file is an Enterprise Security Standards policy document established by Orange County Government Board of County Commissioners in Florida that outlines requirements for external data hosting and the handling of electronic data by vendors and service providers. The policy applies to all vendors, networks, systems, and applications that transmit, process, store, or handle electronic data on behalf of Orange County Government. The solicitation referenced, Web Based Individual Driver Record Checks and Risk Assessments (Y26-1002), requires sealed offers to be submitted electronically via the OpenGov e-Procurement Platform with a submission deadline of 4:00 pm EST on Thursday, October 8, 2026. Questions regarding the solicitation must be submitted by Tuesday, September 8, 2026 at 5:00 pm EST through the OpenGov question and answer module.

The Enterprise Security Standards policy establishes specific data handling requirements that vendors must meet to comply with Orange County's security framework. Vendors are prohibited from accessing Social Security numbers, bank account information, Active Directory usernames, or internal/DMZ networks through hosted applications. All sensitive data including usernames, passwords, names, addresses, phone numbers, email addresses, birthdates, document numbers, account numbers, HIPAA and PCI information must be encrypted at the field-level and in transit. Data disposal must follow sanitization, destruction, or purging methods to render data unrecoverable. Additionally, vendors must ensure their web hosting environment and applications pass yearly penetration tests conducted by Orange County Information Security Services personnel or provide results from an external audit by a reputable third-party security company. The policy was most recently revised in October 2017 to specify field-level encryption requirements and expand third-party audit options.