Higher Education Community Vendor Assessment Toolkit
Assess Vendor Risk and Streamline Your Procurement Processes
The Higher Education Community Vendor Assessment Toolkit™ (HECVAT) is a tool designed to help college and university professionals more easily measure vendor risk.
Created by leaders in higher education in collaboration with EDUCAUSE, Internet2, and REN-ISAC, the HECVAT is a comprehensive questionnaire that companies can complete to provide a detailed picture of their cybersecurity, privacy, and compliance standards in one place—helping higher education leaders make better technology decisions, faster.
If you provide technology services for higher education, or if you would like to share the HECVAT with your current or prospective vendors, download the HECVAT today.
For access to completed assessments, visit the Community Broker Index (CBI). Curious which colleges and universities are using the HECVAT? View a list of institutional HECVAT users.
Announcing HECVAT 4
The HECVAT has undergone significant improvements with guidance from our community, including the addition of questions related to privacy and AI, more flexibility for institutional evaluation, and better training materials for corporations and higher education institutions. Read on to learn more about what's new for HECVAT 4.
Have Questions?
View resources and answers to frequently asked questions for higher education professionals or corporations, or contact us at [email protected]. We're happy to help!
You may also join your peers in the HECVAT Users Community Group on EDUCAUSE Connect to ask questions and stay up-to-date on the toolkit.
HECVAT 4 was created in collaboration with community volunteers, Internet2, and REN-ISAC, with a copyright owned by EDUCAUSE. EDUCAUSE makes HECVAT 4 available to colleges and universities at no cost and without further license from EDUCAUSE. Such institutions may modify HECVAT 4 as appropriate to suit their nonprofit needs and missions. EDUCAUSE additionally makes HECVAT 4 available to college and university vendors, and such vendors may use HECVAT 4 in connection with their college and university business relationships at no cost and without further license from EDUCAUSE. All other parties wishing to use HECVAT 4, including without limitation, third party risk management platforms wishing to integrate HECVAT 4 into their own platforms, must obtain specific permission and license from EDUCAUSE before doing so. EDUCAUSE may be contacted by sending an email to [email protected].