Accessibility in Technology Acquisition with HECVAT 4

The Higher Education Community Vendor Assessment Toolkit (HECVAT) emerged from IT security practitioners; it has since evolved to include contributions from experts in IT accessibility, privacy, and AI.^Footnote1 Are people who are knowledgeable in these areas part of the technology acquisition process at your institution? If not, they should be—their participation is vital in reducing common types of risk. Whether they are currently included, the recently updated HECVAT 4 offers the opportunity for these functions to employ a unified, widely used, community-developed tool that includes legal and technical frameworks used nationwide and worldwide to meet requirements and reduce risk. The tool allows vendor partner providers to efficiently communicate and share key decision-making data with institutions to streamline processes for all parties.

What's New in HECVAT 4 for Accessibility?

Improvements specific to accessibility have been incorporated into the HECVAT 4 update, and they can be used to reduce risk and improve campus collaboration. The improvements fall into five groupings.

Improvements to Document Usability and Accessibility

Easy-to-find accessibility information: One notable improvement for those looking to use the HECVAT for accessibility (or another specific question set) is that accessibility now has its own dedicated tab called "IT Accessibility" in the spreadsheet alongside other areas. This makes it a breeze to find and use this section. HECVAT 3 did the great work of adding accessibility questions to the tool for the first time, but they occupied 12 rows in a large, complicated spreadsheet that contained about 300 rows. Now, the accessibility tab provides a simplified table that makes it much easier to find and use the section.

Document accessibility improvements: The HECVAT continues to be a complex Microsoft Excel workbook. This format is understandable for historical reasons and makes it easier to be a self-contained toolkit offline. Microsoft Excel, like other Microsoft 365 applications, maintains detailed accessibility best practices, which help document authors create and maintain documents that can be read and contributed to by everyone.^Footnote2 The HECVAT now follows many more of these practices, such as improved color contrast, labeled tables, and simplified table layouts compared with the previous version. This improved accessibility was driven by community feedback and will help individuals with disabilities continue to do their jobs more effectively. Like many accessibility improvements, these updates will also help make the HECVAT easier to use for everyone who uses it, regardless of whether they identify as having a disability.

Required Screener Questions

With the growing number of question areas, providers might reasonably wonder whether all sections are required. In HECVAT 4, solution providers start by answering questions that provide guidance on which sections and questions apply to their solution. The screening questions make it easy for a vendor to determine which sections should be answered. In the case of accessibility, the one new screening question asks if the product in question has an interface to be used by someone at the institution. In the style of most HECVAT questions, the answers are designed to elicit binary Yes/No responses. If the answer is "Yes," accessibility questions must be answered for the provider to complete the HECVAT successfully.

Two New Accessibility Questions

HECVAT 4 adds two new accessibility questions. If you are curious about the rationale behind any of the accessibility questions in the HECVAT, the EDUCAUSE Review article "Asking the Right Questions for Procuring Inclusive, Accessible Technology" details the reasons and how practitioners use the answers to help guide purchasing decisions.^Footnote3 The article has been updated to include questions added in HECVAT 3 and 4. Most questions have remained unchanged or slightly modified, though the numbers assigned to questions were updated in HECVAT 4.

New question #1 (ITAC-08): Conformance with accessibility regulations

The Americans with Disabilities Act (ADA) Title II regulations updated in 2024 require all public institutions to adhere to WCAG 2.1 AA in the coming years. In previous versions of the tool, providers were allowed to specify their own technical accessibility standard, and they frequently indicated that they attempted to conform with earlier versions of WCAG, such as 2.0, which is no longer sufficient. While specifying a different standard is still possible in other sections, this question now gives vendors the opportunity to state how they do (or do not) conform to WCAG 2.1 AA, given this explicit regulatory requirement.

All public institutions will be required to ensure that their purchased technologies meet this technical standard by either April 2026 or April 2027, depending on entity size.^Footnote4 Other institutions that receive healthcare or research funding through federal Department of Health and Human Services entities may face similar requirements under separate but similar regulations.^Footnote5 Solution providers seeking to maintain or widen their market share in higher education should meet or exceed the WCAG 2.1 AA or newer technical standards. If they do not, we recommend they create a credible roadmap for their product(s) to conform or risk losing business to alternatives that are able to do so. The totality of the questions in the HECVAT is designed to help institutions make informed purchasing decisions in light of these needs.

New question #2 (ITAC-07): Accessibility in agreements

The community has provided lots of feedback that vendors ought to give assurance and documentation about accessibility conformance as asked throughout the HECVAT. A sticking point often remains unsurfaced until late in the acquisition process, however, because of hesitation among vendors to codify accessibility expectations in agreements, even though commitments for security and privacy are often included in contracts. Question ITAC-07 now gives providers the opportunity to indicate that they will include their commitments for accessibility in contractual agreements.

Enhanced Guidance

Updated guidance for vendors: More guidance is now provided to those completing the HECVAT to clarify expectations from the start for providers. One such example includes question ITAC-14, which asks: "Can you provide a current, detailed accessibility roadmap with delivery timelines?"

Community feedback indicated hesitation from providers to furnish roadmaps for accessibility because such roadmaps often included unreleased product features. Simply put, accessibility of existing product functionality is not a "feature"; it is equal access to a product. An accessibility roadmap is intended to allow solution providers to indicate how they are addressing any known gaps as identified in the supplementary accessibility documentation. The new vendor guidance has been updated to indicate the intent of the question and specify that the roadmap need not include mentions of unreleased products or features: "A detailed accessibility roadmap should reference improvements and progress on known accessibility issues as appropriate but does not necessarily need to list unreleased product features."

Updated guidance for analysts: Colleges and universities increasingly enlist digital accessibility experts to review the results of purchased technology documentation such as a HECVAT. Nonetheless, this is not universal. Given that professionals with varying levels of accessibility expertise may be assessing HECVAT scores, the analyst guidance attempts to assist reviewers who lack accessibility expertise—such as privacy or security analysts—in using the information provided to make informed risk assessment decisions about accessibility. For example, question ITAC-17 asks if all functions of the solution are available using only the keyboard. The analyst reference tab includes a brief explanation about why the question is asked. Potential follow-up actions are suggested if answers are insufficient, including quick reference guides for how someone could test to determine whether an interface is accessible using only the keyboard.

Refreshed Scoring for Accessibility

Previously, all accessibility questions were weighted the same in the scoring process. With input from the IT accessibility community, the HECVAT 4 now gives a higher weight—and therefore greater scoring importance by default—to four critical questions:

• ITAC-06: Has a VPAT or an ACR been created or updated for the solution and version under consideration within the past 12 months?
• ITAC-07: Will your company agree to meet your stated accessibility standard or WCAG 2.1 AA as part of your contractual agreement for the solution?
• ITAC-08: Does the solution substantially conform to WCAG 2.1 AA?
• ITAC-09: Do you have a documented and implemented process for reporting and tracking accessibility issues?

These four questions have the highest importance by default and need not be changed without careful consideration; institutions are able to customize prioritization of other questions for risk assessment as needed.

Overall, HECVAT 4 refreshes scoring with enhanced labels and simpler layout of scored components. Three tabs now present different aspects of scores: Institution Evaluation, High-Risk Evaluation, and Privacy Analyst Evaluation. The Institution Evaluation tab allows institutional analysts to understand how questions are weighted and view the desired, compliant response. With improved labels as a guide, analysts can change response weights or mark a question as non-negotiable. This allows scores to align with any institution-specific requirements. The High-Risk Evaluation tab presents scores and responses for non-negotiable and critical importance questions. If the analyst changes the critical importance or non-negotiable status of any question, this is reflected on the High-Risk Evaluation tab for easy reference.

Other Areas Updated in HECVAT 4

The HECVAT has done a tremendous job of evolving to meet the needs of the higher education community for continued risk assessment and reduction for institutions that use the tool. Just as HECVAT 3 added accessibility questions in 2021, the HECVAT 4 updates featured new question areas for privacy and AI. These have been growing areas of consideration, and the reflection of their value to the community in the most recent version solidifies that.

Acknowledgments and Further Resources

The EDUCAUSE IT Accessibility Community Group has provided tremendous support to and feedback about the accessibility section of the HECVAT in recent years. The immense interest and participation is a sign of the value to the community. With appreciation to all those who participate, special thanks for those who distilled the feedback into actionable updates reflected in HECVAT 4:

• Kyle Shachmut, Harvard University (CG co-chair)
• Eudora Struble, Wake Forest University (CG co-chair)
• Jill Bateman, Ohio University
• Gwen Bostic, Western Michigan University
• Laura Fathauer, Miami University
• Greg Hanek, Indiana University

How are you using the updated HECVAT to streamline communication and assess risk at your institution? The EDUCAUSE HECVAT Users Community Group remains an excellent venue for inquiry and support, and the IT Accessibility CG engages in all sorts of discussions about accessibility on campus, including procurement and use of the HECVAT. Find the right one for you and join the conversation. We are better off working together on big, cross-institutional challenges.

Notes

1. Nichole Arbino and Nick Lewis, "HECVAT 4: Better than Ever," EDUCAUSE Review, February 10, 2025. Jump back to footnote 1 in the text.↩
2. See Accessibility best practices with Excel spreadsheets. Jump back to footnote 2 in the text.↩
3. Kyle Shachmut, "Asking the Right Questions for Procuring Inclusive, Accessible Technology," EDUCAUSE Review, October 25, 2021. Jump back to footnote 3 in the text.↩
4. The compliance deadline depends on the size of the population of the state or local government entity, not the size of your institution. Entities over 50,000 are subject to the April 2026 deadline, while entities under 50,000 have more time, with the April 2027 deadline. Most colleges and universities will likely need to follow the 2026 deadline. Jump back to footnote 4 in the text.↩
5. Jarret Cummings, Kyle Shachmut, and Eudora Struble, "Member QuickTalk: Institutional Views on Web Accessibility Compliance," EDUCAUSE, September 17, 2024. Jump back to footnote 5 in the text.↩

---

Kyle Shachmut is Senior Director of Digital Accessibility Services at Harvard University and co-chair of the EDUCAUSE IT Accessibility Community Group.

Eudora Struble is Director for Technology Accessibility at Wake Forest University and co-chair of the EDUCAUSE IT Accessibility Community Group.