HECVAT 4: Better than Ever

The Higher Education Community Vendor Assessment Toolkit (HECVAT) team has launched HECVAT 4.  Since its creation in 2016, the HECVAT has been a community-driven tool to help institutions evaluate solution providers against the institution's policies and appetite for risk. The new version is better than ever. The improvements in HECVAT 4 would not have been possible without extensive community feedback and stakeholder involvement. Thank you to everyone who provided input through surveys, shared insights at conferences, and conducted rigorous testing of the new version.

Here's what's new in HECVAT 4:

New and Updated Questions

• In 2022, volunteers from the Chief Privacy Officers Community Group created a set of questions to evaluate solution providers' privacy practices and compliance. These questions have been pulled into HECVAT 4. In addition, a tab for a privacy analyst to provide input on a completed HECVAT has been added.
• As artificial intelligence (AI) continues to proliferate, the need to assess how AI is used in solutions is more important than ever. HECVAT 4 includes a set of AI-specific questions developed by community volunteers to help institutions assess the AI components of the solutions they use.
• While the question set is extensive, solution providers need to complete the HECVAT only once per year. It can be shared with any institution without the need for changes. The new version allows institutions to customize their review depending on their requirements.

More Flexibility for Institutional Evaluation

• HECVAT 4 rolls the HECVAT Full, Lite, and On-Prem into one file. Solution providers start by answering questions that guide them on which questions apply to their solution. This step helps alleviate confusion about which version to complete, streamlining the process with institutions.
• The Institution Evaluation tabs allow the user to choose which categories to include in a solution's score; mark items as "non-negotiable," which pulls those items into a new tab so they are viewable in one place; and see a "high risk" score for a more lightweight solution evaluation. The HECVAT Lite questionnaire functionality has also been updated.

Training Materials for Institutions and Solution Providers

• With the launch of HECVAT 4, we've also introduced a new website. The new website features improved training materials, including instructions to help solution providers submit their best HECVAT and instructions to help institutions get the most out of the tool. We will keep expanding the library of training materials based on user requests. Visit the HECVAT website to learn more.

Trademark and Copyright of the HECVAT Brand

• The HECVAT name is now trademarked, and copyright has been obtained to protect the work of the community. This does not change how institutions or solution providers use the tool, and we will work with third-party risk management platforms that have integrated the HECVAT into their tool to ensure organizations have the proper license to continue using it.

HECVAT 4 is a significant change from past versions, and the HECVAT team is committed to supporting institutions and solution providers in transitioning from past versions. We will be hosting office hours over the next several weeks so the community can ask the HECVAT Advisory Committee questions. Office hours are listed on the HECVAT website landing page. Community members can also post to the HECVAT Users community group at any time or email [email protected].

Nichole Arbino is a Senior Program Manager at EDUCAUSE.

Nick Lewis is Program Manager, NET+ Cloud Services, Security and Identity, at Internet2.