Higher Education Community Vendor Assessment Toolkit

Molecular model-like shapes on a blue-black background overlaid with the text HECVAT Shared assessments of security risks in cloud and on-premises services
The HECVAT was created by the Higher Education Information Security Council (HEISC) Shared Assessments Working Group, in collaboration with Internet2 and REN-ISAC. For more information or questions, email us at [email protected].


What is the HECVAT?

For Colleges and Universities—The HECVAT is a questionnaire framework specifically designed for higher education to measure vendor risk. Before you purchase a third-party solution, ask the solution provider to complete a HECVAT tool to confirm that information, data, and cybersecurity policies are in place to protect your sensitive institutional information and constituents' PII.

For Solution Providers—Complete the assessment tool and share it in the Cloud Broker Index. Once completed, your assessment can be used by multiple institutions to streamline procurement processes with your higher ed clients.


Who Uses the HECVAT?

Join the coalition of 150+ colleges and universities and 50+ solution providers who use the HECVAT to reduce risk and save time and money.

"The HECVAT is an example of how increasing collaboration across higher education institutions and organizations can facilitate advances in security risk management and streamline procurement processes."
Nick Lewis, Program Manager, Security and Identity, Internet2

Related Resources