HECVAT

The Higher Education Community Vendor Assessment Toolkit: the security questionnaire that universities and colleges send to the software vendors they buy from.

The HECVAT is maintained by EDUCAUSE for higher education institutions assessing vendors. It covers data handling, access, application security, policies and, where relevant, accessibility and privacy.

Vendors selling to universities are usually asked for it early, and a completed HECVAT is often shared with several institutions.

What a reviewer wants to see

• A completed, current HECVAT
• Supporting documents such as a SOC 2 report or penetration test summary