Anyone who works in higher education, or for a solution provider that serves colleges and universities, may have heard the term HECVAT before. If not, it’s only a matter of time.
According to EDUCAUSE, higher-ed institutions are increasingly moving toward digital and cloud-based solutions. As this shift continues, data protection and security are becoming top priorities for school IT teams and their leaders. This means that understanding and leveraging HECVAT will quickly become a necessity for many institutions.
What is HECVAT?
The Higher Education Community Vendor Assessment Toolkit (HECVAT) is a security-questionnaire template designed specifically to measure vendor risk for higher education institutions. HECVAT was created by the Higher Education Information Security Council (HEISC) Shared Assessments Working Group, in collaboration with Internet2 and REN-ISAC, and has seen several revisions over the past years. Its purpose is to provide a starting point for the assessment of vendor-provided services and resources in higher education.
Over 100 colleges and universities already use HECVAT, and more than 30 vendors have made their HECVAT assessments available online at REN-ISAC.
Want to read Kivuto’s completed HECVAT assessment? Get it here.
Why is HECVAT important?
Information security has been the top IT issue for the past five years. Privacy and digital-integration concerns also placed high among EDUCUASE’s Top 10 IT Issues for 2020. In this era of information security, safeguarding sensitive data and protecting personally identifiable information (PII) is more important than ever. However, the process of ensuring compliance and security often takes up resources that many IT teams don’t have to spare.
HECVAT helps in two key areas:
- Reducing burden: Higher education institutions save time when evaluating third-party products and solutions. HECVAT is an easy way to request a security assessment that many service providers are already familiar with.
- Standardizing risk assessment: HECVAT is a consistent, easily adopted framework that appropriately assess security and privacy needs unique to higher education.
What are the different HECVAT versions?
HECVAT is now a suite of tools that allows colleges and universities to select the correct assessment for their needs. These tools include:
- HECVAT – Full: Robust questionnaire (250+ questions) for the most critical data-sharing engagements.
- HECVAT – Lite: A lightweight version of the full assessment used for an expedited or less-critical process.
- HECVAT – Triage: Used by vendors during a risk-assessment request.
- HECVAT – On-Premise: A unique questionnaire for evaluating on-premise appliances and software.
Summary
HECVAT is an important risk-management asset for universities and colleges that leverage third-party tech services and solutions. Request Kivuto’s HECVAT assessment or learn more about how Kivuto Cloud can help your institution manage and distribute software, digital resources, and cloud licenses securely and in compliance with all privacy standards.
