12-Vendor Security Documents Checklist Version 4.docx

This is an IT Security Artifact Checklist document issued by Inland Empire Health Plan (IEHP), a California-based health plan organization, for vendor security compliance and assessment purposes. The checklist outlines mandatory and recommended security documentation requirements that vendors must submit for IT Security review, applicable across five vendor categories: New Vendors, Existing Vendors, Business Process vendors, Vendor SaaS providers, and Vendor Software (On-Premise) providers, as well as Consulting/Staff Augmentation contractors. The document does not specify project quantities, response dates, due dates, site visits, bidder conferences, award dates, or contract terms; rather, it functions as an internal compliance framework for ongoing vendor management.

The checklist identifies mandatory items (marked with asterisks) that include the IEHP Data Sharing Assessment, IEHP Security Assessment Tool, List of Emergency Contacts, Disaster Recovery/Business Continuity Plan, HITRUST/ISO 27001/FedRAMP/StateRAMP certification, Penetration Test results from within the last 365 days, SOC 2 Type II Audit Results, Cyber Liability Insurance (minimum $3 million for under 50,000 members; $10 million for over 1 million members), Network Diagram, Data Flow Diagram, Total records stored in vendor sites, and List of Data Center Locations. Additional recommended documentation includes Non-Disclosure Agreements, Professional Service Agreements, Statements of Work, Master Service Agreements, Business Associate Agreements, penetration test vulnerability lists, SOC 2 reports, security tools inventory, SecOps/DevSecOps practices documentation, cyber tabletop exercise results, and disaster recovery testing reports. The checklist applies to the contracted Printing, Mailing, and Fulfillment Services vendor scope but serves as a standardized security governance tool for all IEHP vendor relationships.