ISS_-_Enterprise_Security_Standards_-_External_Data_HostingRev3.pdf

This document is an Enterprise Security Standards policy for External Data Hosting, issued by the Orange County Government Board of County Commissioners (OCGBCC) in Florida. The policy establishes comprehensive standards for the retrieval, storage, transmission, processing, and handling of electronic data by vendors, networks, systems, and applications. The document outlines strict requirements for data input, processing, storage, handling, transmission, and disposal, with a primary focus on protecting sensitive information such as Social Security numbers, bank information, usernames, passwords, and other personally identifiable data.

The policy mandates field-level encryption for specific types of data both at rest and in transit, requires data transmission through encrypted tunnels, and prescribes detailed methods for data disposal including sanitization, physical destruction, and magnetic purging. Vendors must ensure web hosting environments and applications are secured using information security best practices and must either pass a yearly penetration test conducted by Orange County ISS personnel or provide results from an external audit by a reputable third-party security company. The document was last revised in October 2017, with updates including specification of field-level encryption, addition of usernames and passwords to encryption requirements, and providing an alternative option for external security audits.