10-Vendor Security Documents Checklist.docx

This is a Vendor IT Security Artifact Checklist for Inland Empire Health Plan (IEHP) used to evaluate vendor compliance with security and data protection requirements across multiple vendor categories including SaaS providers, on-premises software vendors, consulting firms, and staff augmentation contractors. The checklist establishes mandatory and recommended documentation standards that vendors must provide to demonstrate their security posture and operational readiness. Mandatory items for all vendor types include Business Associate Agreements (BAAs), Disaster Recovery/Business Continuity Plans, HITRUST/ISO 27001/FedRAMP/StateRAMP certifications with full assessment reports, penetration tests completed within the last 365 days with vulnerability remediation status, IEHP Data Sharing Assessments, IEHP Security Assessment Tool results, network diagrams, data flow diagrams, cyber liability insurance, list of emergency contacts, total records stored in vendor systems, and data center location information. Additional recommended artifacts include Non-Disclosure Agreements, Professional Service Agreements, Statements of Work, Master Service Agreements, SOC 2 Type II Audit results, Security Tools inventories, SecOps/DevSecOps practices documentation, Cyber Tabletop Exercise results, and Disaster Recovery Testing results.

Cyber liability insurance requirements are scaled based on IEHP membership size, requiring minimum coverage of $3 million for under 50,000 members and $10 million for over 1 million members. The checklist indicates that existing vendors require updated BAAs only if their current agreement predates the most recent contract update. All penetration test reports must include identification and remediation status of critical and high-severity vulnerabilities, and Disaster Recovery Testing results require submission of full test reports. Network diagrams and data flow diagrams are mandatory, as is documentation of all data center locations and the total volume of records stored within vendor systems, ensuring IEHP maintains comprehensive visibility into vendor security infrastructure and data handling practices.