7-Vendor Security Documents Checklist Version 4.docx

This document is an IEHP Vendor IT Security Artifact Checklist that outlines mandatory and recommended security documentation requirements for vendors engaging with Inland Empire Health Plan (IEHP) in California across multiple vendor categories including SaaS providers, on-premises software vendors, consulting firms, and business process vendors. The checklist establishes a comprehensive framework for IT security compliance, with mandatory items marked by asterisks that all vendors must provide regardless of vendor type. Key mandatory requirements include completion of the IEHP Data Sharing Assessment and IEHP Security Assessment Tool, submission of Disaster Recovery and Business Continuity Plans, maintenance of current certifications such as HITRUST, ISO 27001, or FedRAMP/StateRAMP credentials with full assessment reports, penetration testing results from within the last 365 days with vulnerability documentation, cyber liability insurance coverage, and emergency contact lists. Additional mandatory documentation for most vendor types includes network diagrams, data flow diagrams, data center location lists, and total records storage information.

The checklist also identifies strongly recommended supporting artifacts that enhance the security posture evaluation, including SOC 2 Type II audit results, disaster recovery testing reports, cybersecurity tabletop exercise results, lists of security tools deployed, and SecOps/DevSecOps practice documentation. Cyber liability insurance requirements are tiered based on IEHP membership size, requiring a minimum of three million dollars coverage for plans with fewer than 50,000 members and ten million dollars for plans exceeding one million members. This security framework supports IEHP's clinical review services operations in California by ensuring that all vendor partners maintain robust information security controls, business continuity capabilities, and documented compliance with healthcare data protection standards necessary to support regulatory requirements for physician-level review of prior authorizations, grievances, and quality incidents.