The highly anticipated Version 4 of The Higher Education Community Vendor Assessment ToolkitTM (HECVAT) has arrived, which is big news for the higher ed. IT community and the software vendors who serve the industry.
For HECVAT veterans, the inclusion of AI-related questions for vendors probably serves as HECVAT 4’s major highlight. The critical area of data privacy also receives a more in-depth treatment. It also includes a streamlined process for vendors attempting to complete the assessment, which should hopefully lead to even more assessed products. According to The Research & Education Networks Information Sharing & Analysis Center (REN-ISAC), vendors offering nearly 200 products have completed a HECVAT assessment. REN-ISAC tracks the current list (https://www.ren-isac.net/hecvat/cbi.html) as reported by vendors.
Educause has a dedicated Version 4 webpage (https://er.educause.edu/articles/2025/2/hecvat-4-better-than-ever) for those with HECVAT experience, bringing together relevant HECVAT 4 enhancements and other details. Much thanks go to the 21 individuals who served as HECVAT 4 volunteers and the nine-person HECVAT Advisory Committee. These folks join dozens of others who have pitched in over the years.
For newcomers, HECVAT is a no-cost questionnaire for vendors intended to assess cybersecurity, risk mitigation and privacy practices applicable to a product. Created in 2016 and governed by a mix of higher education IT experts along with industry heavyweights like Educause, REN-ISAC, and Internet2, HECVAT is fortunately driven by the higher education community itself. Compliance to items driven by an external force - such as federal or state law - may not meet the industry’s evolving needs in a complete and/or timely manner.
The HECVAT questionnaire for vendors is very extensive. Depending on certain factors, vendors can be asked to supply some 350 general facts or answers to questions in offering institutions a complete assessment. Like the HECVAT itself, the questionnaire is higher education-centered, which is a big plus. Questionnaire components include:
HECVAT also provides institutions with an impressive customizable mechanism to evaluate the vendor assessment based on institution-specific requirements and priorities. Educause supplies a brief video demonstration for institutions (https://www.youtube.com/watch?v=yC3_cK0e1bg) and more complete tips and best practices for written format (https://www.educause.edu/higher-education-community-vendor-assessment-toolkit/how-to-use-the-higher-education-community-vendor-assessment-toolkit).
Institutions can use these results to determine if the product is viable – or even preferable – based on how the product complies with the institution’s expectations or requirements. The questionnaire’s goal is to provide institutions with a deep perspective on a software product’s status in the critical areas of cybersecurity and privacy. It also holds the potential to look at competing products in these areas with an apples-to-apples to view.
More than 180 higher education entities have publicly reported their use of HECVAT. Since some of these entities are consortiums or State Systems and some likely have not reported usage publicly, the number of actual institutions using HECVAT is larger. The HECVAT 4 expansion into AI, privacy, etc. should bring even more participation.
The go-to resource for ‘all things HECVAT’ is part of the Educause website (https://www.educause.edu/higher-education-community-vendor-assessment-toolkit). The FAQ sections for institutions and corporations are most helpful for both the novice and the experienced individual.
Bill Balint is the owner of Haven Hill Services LLC, contracted as TriVigil’s Advisory CIO for Education.