7-Vendor Security Documents Checklist Version 4.docx

This is a Vendor IT Security Artifact Checklist from IEHP (Inland Empire Health Plan) establishing mandatory and recommended security documentation requirements for vendors providing services to the organization. The checklist applies across multiple vendor categories including new vendors, existing vendors, business process vendors, SaaS vendors, on-premises software vendors, and consulting/staff augmentation providers. The document outlines 21 distinct security artifacts organized by vendor type, with asterisks (*) denoting the 10 mandatory requirements that all vendors must provide regardless of service category. These mandatory items include Business Continuity/Disaster Recovery plans, industry-standard security certifications (HITRUST/ISO 27001/FedRAMP/StateRAMP), penetration testing results from within the past 365 days, SOC 2 Type II audit reports, IEHP-specific data sharing and security assessments, cyber liability insurance, network and data flow diagrams, emergency contact lists, total record counts stored at vendor sites, and data center location information.

The security requirements reflect IEHP's role as a health plan managing sensitive protected health information (PHI) and establish tiered cyber liability insurance minimums based on member population size: a minimum of $3 million in coverage for plans under 50,000 members and $10 million for plans exceeding 1 million members. The checklist specifies that penetration testing must provide documentation of critical and high vulnerabilities along with remediation status, while SOC 2 Type II reports require either full reports or executive summaries identifying critical and high vulnerabilities with current status. For existing vendors, Business Associate Agreements must be renewed if the current BAA predates the most recent contract update. The document is structured to ensure comprehensive security documentation is uploaded through Conga, IEHP's submission platform, facilitating centralized IT security review for vendors supporting the California health plan's Electronic Health Record System and related operations.