Y22-178_Attachment_D_-_OC_Enterprise_Encryption_Standards.pdf

This document is an Enterprise Security Standards, Policies, and Guidelines document specifically an External Data Hosting Standard from Orange County Government Board of County Commissioners (OCGBCC). The purpose of this standard is to establish guidelines for the proper retrieval, storage, transmission, processing, and handling of electronic data. The document applies to all vendors, networks, systems, and applications that will transmit, process, store, or handle electronic data for the county.

The standard provides comprehensive policies for data input, processing, storage, handling, transmission, and disposal, with specific focus on protecting sensitive information. Key security requirements include encrypting data at field-level, restricting access to social security numbers and bank information, mandating data sanitization methods upon disposal, and requiring external audits of hosting environments. The document specifies three data disposal methods: sanitization (overwriting stored data), destruction (physically damaging storage media), and purging data using strong magnetic devices. The standard was last revised in October 2017, with updates including specifying field-level encryption for sensitive data and adding options for third-party vendor security assessments.