8-Vendor Security Documents Checklist Version 4.docx

The document is an IT Security Artifact Checklist from Inland Empire Health Plan (IEHP) for vendors seeking to contract with the organization. The checklist outlines comprehensive security documentation requirements for various types of vendors, including new and existing vendors across business processes, SaaS, software, on-premises solutions, and consulting/staff augmentation services. Mandatory documentation includes disaster recovery/business continuity plans, security certifications (HITRUST/ISO 27001/FedRAMP), penetration test results, SOC 2 Type II audit reports, network and data flow diagrams, security assessments, and emergency contact lists.

The checklist specifies detailed security documentation requirements with varying mandates depending on vendor type, including cyber liability insurance (3-10 million dollars based on member count), security tool inventories, and data center location information. Vendors must provide comprehensive security artifacts, with asterisked items being mandatory across all vendor categories. The document emphasizes thorough security vetting, requiring recent (within 365 days) vulnerability assessments, full test reports, and detailed documentation to ensure robust information security practices for potential IEHP vendor partnerships.