Are you a student or faculty member? Visit OnTheHub for discounted software and support or Texidium for eText support.

Close Button

What is HECVAT and Why is it Important?

Elizabeth MacDougall
July 17, 2020
Featured Image - Cloud Icon on Shield Symbol with Dark Background

Anyone who works in higher education, or for a solution provider that serves colleges and universities, may have heard the term HECVAT before. If not, it’s only a matter of time.

According to EDUCAUSE, higher-ed institutions are increasingly moving toward digital and cloud-based solutions. As this shift continues, data protection and security are becoming top priorities for school IT teams and their leaders. This means that understanding and leveraging HECVAT will quickly become a necessity for many institutions.

What is HECVAT?

The Higher Education Community Vendor Assessment Toolkit (HECVAT) is a security-questionnaire template designed specifically to measure vendor risk for higher education institutions. HECVAT was created by the Higher Education Information Security Council (HEISC) Shared Assessments Working Group, in collaboration with Internet2 and REN-ISAC, and has seen several revisions over the past years. Its purpose is to provide a starting point for the assessment of vendor-provided services and resources in higher education.

Over 100 colleges and universities already use HECVAT, and more than 30 vendors have made their HECVAT assessments available online at REN-ISAC.

Want to read Kivuto’s completed HECVAT assessment? Get it here.

Why is HECVAT important?

Information security has been the top IT issue for the past five years. Privacy and digital-integration concerns also placed high among EDUCUASE’s Top 10 IT Issues for 2020. In this era of information security, safeguarding sensitive data and protecting personally identifiable information (PII) is more important than ever. However, the process of ensuring compliance and security often takes up resources that many IT teams don’t have to spare.

HECVAT helps in two key areas:

  • Reducing burden: Higher education institutions save time when evaluating third-party products and solutions. HECVAT is an easy way to request a security assessment that many service providers are already familiar with.
  • Standardizing risk assessment: HECVAT is a consistent, easily adopted framework that appropriately assess security and privacy needs unique to higher education.

What are the different HECVAT versions?

HECVAT is now a suite of tools that allows colleges and universities to select the correct assessment for their needs. These tools include:

  • HECVAT – Full: Robust questionnaire (250+ questions) for the most critical data-sharing engagements.
  • HECVAT – Lite: A lightweight version of the full assessment used for an expedited or less-critical process.
  • HECVAT – Triage: Used by vendors during a risk-assessment request.
  • HECVAT – On-Premise: A unique questionnaire for evaluating on-premise appliances and software.


HECVAT is an important risk-management asset for universities and colleges that leverage third-party tech services and solutions. Request Kivuto’s HECVAT assessment or learn more about how Kivuto Cloud can help your institution manage and distribute software, digital resources, and cloud licenses securely and in compliance with all privacy standards.

Elizabeth MacDougall
July 17, 2020

Leave A Comment

Your email address will not be published. Privacy Policy

Looking To Get Started?

How can Kivuto help your institution? Click the button below to start a conversation with one of our solution experts.

Privacy Preferences

When you visit our website, it may store information through your browser from specific services, usually in the form of cookies. Here you can change your privacy preferences. It is worth noting that blocking some types of cookies may impact your experience on our website and the services we are able to offer.

Click to enable/disable Google Analytics tracking code.
Click to enable/disable Google Fonts.
Click to enable/disable Google Maps.
Click to enable/disable video embeds.

To ensure the best possible experience, this website uses cookies. Click the button below to agree to the use of cookies.