7-Vendor Security Documents Checklist Version 4.docx

This is a vendor IT security artifact checklist used by Inland Empire Health Plan (IEHP) to evaluate security documentation and compliance posture for vendors providing services in California. The checklist applies to new vendors, existing vendors, business process vendors, SaaS vendors, on-premises software vendors, and consulting/staff augmentation providers. Required artifacts include mandatory items marked with asterisks, such as Disaster Recovery/Business Continuity Plans, HITRUST/ISO 27001/FedRAMP/StateRAMP certifications with full assessment reports, penetration tests completed within the last 365 days showing critical and high vulnerabilities with remediation status, SOC 2 Type II audit results, IEHP Data Sharing Assessments, IEHP Security Assessment Tool completion, network diagrams, data flow diagrams, list of emergency contacts, total records stored on vendor sites, and list of data center locations. Additional recommended documentation includes Non-Disclosure Agreements, Professional Service Agreements, Statements of Work, Master Service Agreements, Business Associate Agreements (new BAA required if current is older than most recent contract), SOC 2 audit reports or executive summaries, security tools inventories, SecOps/DevSecOps practices documentation, cyber tabletop exercise results, and disaster recovery testing results with full reports.

Cyber liability insurance requirements are tiered based on member population: a minimum of three million dollars coverage is required for organizations with under 50,000 members, while organizations with over one million members must maintain ten million dollars of coverage. All vendors must submit documentation through Conga for IEHP IT Security review, with the checklist designed to ensure comprehensive security assessment across multiple vendor types and operational models. The evaluation framework applies a consistent set of security and compliance standards across all vendor categories to protect IEHP's data and operational continuity.