8-Vendor Security Documents Checklist Version 4.docx

The document is an IEHP (Inland Empire Health Plan) Vendor IT Security Artifact Checklist designed to standardize security documentation requirements for various types of vendors, including new and existing vendors across business process, SaaS, software, and consulting/staff augmentation categories. The checklist mandates comprehensive security documentation such as Non-Disclosure Agreements (NDAs), Professional Service Agreements (PSAs), Master Service Agreements (MSAs), Business Associate Agreements (BAAs), Disaster Recovery/Business Continuity Plans, and security certifications like HITRUST, ISO 27001, FedRAMP, and StateRAMP.

The checklist requires vendors to provide detailed security documentation, including penetration test results from within the last 365 days, SOC 2 Type II audit reports, network and data flow diagrams, lists of security tools, cyber liability insurance (with coverage ranging from 3-10 million dollars depending on member count), and emergency contact information. Additionally, vendors must complete IEHP's Data Sharing and Security Assessment Tools, demonstrate SecOps/DevSecOps practices, provide disaster recovery testing results, and disclose total records stored and data center locations. The document is associated with a state and local contract opportunity for Emergency Supply Distribution Assessment Services in Puerto Rico, suggesting a potential healthcare or emergency preparedness context for the security requirements.