Higher Education Community Vendor Assessment Toolkit

What it is

EDUCAUSE's own page names the full title: "Higher Education Community Vendor Assessment Toolkit™ (HECVAT)".

EDUCAUSE's own page states: "Created by leaders in higher education in collaboration with EDUCAUSE, Internet2, and REN-ISAC." It is a joint product of three organizations, not a single institution's tool.

The current release is HECVAT 4.1.6, part of the HECVAT 4 family, per EDUCAUSE's own page.

EDUCAUSE describes the licensing terms on its own page: "EDUCAUSE makes HECVAT 4 available to colleges and universities at no cost and without further license."

Nowhere on the page reviewed does EDUCAUSE call HECVAT a certificate; it uses "assessment toolkit" and "questionnaire" instead — HECVAT is not a certification and no vendor is described as becoming "HECVAT certified."

Who owns it

HECVAT is hosted and administered through EDUCAUSE, developed jointly with Internet2 and REN-ISAC — per EDUCAUSE's own page, it is not the product of one organization.

Who assesses it

HECVAT is a self-assessment: the vendor itself completes and returns the questionnaire. The EDUCAUSE page reviewed does not describe an independent third-party assessor role for HECVAT itself.

Who asks for it

Colleges and universities use HECVAT to assess vendors that will handle institutional data. EDUCAUSE's own page also states that third-party risk-management platforms may only integrate HECVAT into their own offerings with EDUCAUSE's separate permission — vendors completing the questionnaire for their own submission do not need that additional license.