7-Vendor Security Documents Checklist Version 4.docx

This is a Vendor IT Security Artifact Checklist document created by Inland Empire Health Plan (IEHP), a local public entity serving over 1.4 million members across Riverside and San Bernardino counties in California, to evaluate vendor security compliance for a janitorial services staffing augmentation contract. The RFP #26-07128, issued on May 12, 2026, seeks vendors to provide temporary janitorial staffing across eight facility locations, including trash and recycling removal, restroom sanitation, floor care, surface disinfection, and project-based services. Personnel must work day shift (7:00 AM–6:00 PM) and swing shift (5:00 PM–1:30 AM) under IEHP's Environmental Services Supervisor direction. All assigned staff must possess commercial janitorial experience, OSHA safety training, bloodborne pathogen certification, and active California Janitorial Service Providers Registry registration per AB 1978. Bidders must submit questions by 5:00 p.m. PT on May 15, 2026, with proposals due by 2:00 p.m. PT on May 29, 2026. The initial contract term is one year with options to renew for up to four additional one-year periods at IEHP's discretion.

The security checklist mandates vendors submit numerous IT security artifacts as mandatory requirements, including a completed IEHP Data Sharing Assessment, IEHP Security Assessment Tool, disaster recovery and business continuity plans, penetration testing results (within 365 days), SOC 2 Type II audit reports, network and data flow diagrams, cybersecurity certifications (HITRUST/ISO 27001/FedRAMP/StateRAMP), and a list of critical or high vulnerabilities with remediation status. Cyber liability insurance is required with minimum coverage of $3 million for IEHP membership under 50,000 members; given IEHP's 1.4 million member base, the requirement escalates to $10 million coverage. Additional documentation includes disaster recovery testing results, emergency contact lists, total records stored at vendor sites, and data center locations. Pricing proposals must include fully inclusive blended hourly rates for Environmental Service Technician I and Technician II positions with separate overtime rates. Evaluation criteria allocate 65 points to scope and company qualifications, 30 points to pricing, and 5 points for local preference, with an additional 10 points possible for demonstrations or interviews.