Higher Education Community Vendor Assessment Toolkit™

Published:
Policies, Guidelines, Plans and Toolkits
Author(s) and Contributors:
Source(s) and Collection(s):
Sources(s): Higher Education Information Security Council (HEISC) Community
ParentTopics:
Agreements and Contract Management Cloud Computing and Services Cloud Computing Contracts Cloud Security Compliance Cybersecurity Data Privacy Data Security Risk Management Security Risk Management Standards Technology Selection Vendor Management
Molecular model-like shapes on a blue-black background overlaid with the text HECVAT Shared assessments of security risks in cloud and on-premises services
The HECVAT created by the Shared Assessments working group (previously referred to as the Higher Education Information Security Council Shared Assessments working group), in collaboration with Internet2 and REN-ISAC. For more information or questions, email us at [email protected].

 

What is the HECVAT?

For Colleges and Universities—The HECVAT is a questionnaire framework specifically designed for higher education to measure vendor risk. Before you purchase a third-party solution, ask the solution provider to complete a HECVAT tool to confirm that information, data, and cybersecurity policies are in place to protect your sensitive institutional information and constituents' PII.

For Solution Providers—Complete the assessment tool and share it in the Cloud Broker Index. Once completed, your assessment can be used by multiple institutions to streamline procurement processes with your higher ed clients.

 

Who Uses the HECVAT?

Join the coalition of 150+ colleges and universities and 50+ solution providers who use the HECVAT to reduce risk and save time and money.

The HECVAT Tools

The most current versions are linked below. Click on a tool to view the version number. See the Change Log in each spreadsheet to view earlier versions.

square purple tile
HECVAT FULL 3.06 Assess the most critical data-sharing engagements
square gold tile
HECVAT LITE 3.06 Condensed version to expedite process
square green tile
TRIAGE Identify which tool to use for your assessment
square brown tile
ON-PREMISE Evaluate on-premise appliances and software
square blue tile
COMMUNITY BROKER INDEX View completed vendor assessments
square copper tile
USERS GROUP Forum to ask questions, request changes

"The HECVAT is an example of how increasing collaboration across higher education institutions and organizations can facilitate advances in security risk management and streamline procurement processes."
—Nick Lewis, Program Manager, Security and Identity, Internet2

Related Resources