8-Vendor Security Documents Checklist Version 4.docx

This is an IT Security Artifact Checklist document prepared by IEHP (Inland Empire Health Plan) for vendor compliance evaluation, applicable to new vendors, existing vendors, and various service categories including SaaS, on-premise software, and staffing augmentation consulting services in California. The checklist establishes mandatory and recommended security documentation requirements that vendors must submit through Conga for IEHP IT Security review, with specific artifacts tailored to vendor type and service model.

The mandatory requirements (*items) include Business Associate Agreements, Disaster Recovery/Business Continuity Plans, current HITRUST/ISO 27001/FedRAMP/StateRAMP certifications with full assessment reports, penetration tests completed within the last 365 days with vulnerability lists, IEHP Data Sharing Assessments, IEHP Security Assessment Tool submissions, network and data flow diagrams, cyber liability insurance (minimum $3 million for under 50,000 members or $10 million for over 1 million members), disaster recovery testing results with full reports, emergency contact lists, total records stored metrics, and data center location documentation. Additional recommended artifacts include Non-Disclosure Agreements, Professional Service Agreements, Master Service Agreements, SOC 2 Type II audit results, security tools inventories, and SecOps/DevSecOps practice documentation. The checklist applies uniformly across all vendor categories and service types, ensuring comprehensive security and operational due diligence prior to contract execution.