7-Vendor Security Documents Checklist Version 4.docx

This is a vendor IT security artifact checklist developed by IEHP (Inland Empire Health Plan) to establish security documentation requirements for new and existing vendors across multiple service categories including SaaS, software, consulting, and staff augmentation. The checklist identifies mandatory and recommended security artifacts that vendors must submit through Conga for IEHP IT Security review. Key mandatory requirements include disaster recovery and business continuity plans, HITRUST/ISO 27001/FedRAMP/StateRAMP certifications with full assessment reports, penetration tests completed within the last 365 days with critical and high vulnerability lists, SOC 2 Type II audit results, IEHP data sharing assessments, IEHP security assessment tool completion, network and data flow diagrams, list of emergency contacts, total record counts stored in vendor sites, and data center locations. Additional mandatory items include cyber liability insurance with minimum coverage of $3 million for vendors managing information on under 50,000 members or $10 million for over 1 million members.

The checklist also requires submission of non-disclosure agreements, professional service agreements, statements of work, master service agreements, and business associate agreements (with new BAAs required if the current agreement predates the most recent contract update). Non-mandatory but recommended security artifacts include SOC 2 Type II audit reports or executive summaries, list of security tools deployed, SecOps/DevSecOps practices documentation, cyber tabletop exercise results, and disaster recovery testing results with full test reports. This comprehensive security framework applies consistently across all vendor types to ensure compliance with IEHP's data protection and operational resilience standards.