HECVAT (Higher Education Community Vendor Assessment Toolkit) is a standardized questionnaire that colleges, universities, and their affiliated research institutions use to evaluate the data security and privacy practices of a vendor before signing a contract — especially cloud-hosted software, SaaS platforms, and other third-party services that will touch institutional or research data. Instead of every institution writing its own security questionnaire, HECVAT gives procurement and IT-security offices a common, reusable set of questions, and gives vendors a single assessment they can complete once and reuse across many higher-ed customers.
For a lab or research-computing group, HECVAT most often shows up when procuring a cloud-based laboratory information management system (LIMS), electronic lab notebook (ELN), survey or data-collection platform, cloud storage, or any other vendor that will store, process, or transmit research data, human-subjects data, or other sensitive institutional information. This guide covers what HECVAT is, who maintains it, the different versions, what it actually assesses, and how it fits into a lab or department’s procurement workflow.
What HECVAT stands for and what it is
HECVAT stands for Higher Education Community Vendor Assessment Toolkit. It is a set of standardized questionnaires — not a certification, audit, or scoring system — that a vendor fills out to describe its data security, privacy, and compliance posture. The completed questionnaire is then reviewed by the purchasing institution’s IT security, privacy, or procurement office as part of due diligence before a contract is signed or renewed.
HECVAT was developed specifically for higher education’s needs, which differ from generic enterprise vendor-risk questionnaires in a few ways: it asks about handling of student records governed by FERPA, research data subject to funder or IRB requirements, and the multi-tenant, decentralized purchasing environment typical of universities where individual departments, labs, and centers often procure software independently of central IT.
Who publishes and maintains HECVAT
HECVAT was created by the Higher Education Information Security Council (HEISC) Shared Assessments Working Group, in collaboration with Internet2 and REN-ISAC (the Research and Education Networking Information Sharing and Analysis Center). The toolkit and its supporting materials — including the Community Broker Index, a shared repository where vendors can publish completed assessments for institutions to review — are now hosted and maintained through the EDUCAUSE library and community, reflecting EDUCAUSE’s broader role as the higher-education IT association that houses HEISC.
The HECVAT versions
HECVAT is published as more than one version so that the depth of the assessment can be matched to the risk level of what’s being procured:
- HECVAT Full — the comprehensive version, covering the widest range of security, privacy, and operational domains. This is the version institutions typically require for vendors handling sensitive data (regulated research data, PHI/PII, financial data) or providing mission-critical, deeply integrated services.
- HECVAT Lite — a shorter, streamlined version built from a subset of the highest-priority questions in the Full version. It’s used for lower-risk engagements where a full review would be disproportionate to the actual exposure — a small departmental tool with limited or no sensitive-data handling, for example.
- HECVAT On-Prem — a version adapted for software that is installed and run on the institution’s own infrastructure rather than delivered as a cloud/SaaS service, since on-premise deployments raise a different set of questions (e.g., less emphasis on the vendor’s own data-center controls, more on how the software behaves inside the institution’s network).
Which version applies is a decision made by the purchasing institution’s security or procurement office, generally based on a data-classification or risk-tiering exercise done before the assessment is sent to the vendor.
What HECVAT actually assesses
A completed HECVAT gives a reviewer a structured picture of a vendor’s practices across areas that commonly include:
- Data security — encryption in transit and at rest, key management, network security controls.
- Data privacy and data handling — what data is collected, how it’s used, retention and deletion practices, and data residency/location.
- Application and infrastructure security — secure development practices, vulnerability management, patching cadence.
- Identity, authentication, and access control — support for single sign-on and federated identity (relevant to campus identity systems), multi-factor authentication, role-based access.
- Business continuity and disaster recovery — backup practices, uptime commitments, incident recovery plans.
- Incident response and breach notification — how and how quickly the vendor commits to notifying a customer institution of a security incident.
- Subcontractors and fourth-party risk — whether the vendor relies on other subprocessors, and how those relationships are managed.
- Compliance and certifications — whether the vendor holds relevant third-party attestations such as SOC 2 or ISO/IEC 27001, and can supply supporting audit reports.
HECVAT doesn’t replace those third-party certifications — it’s a self-attestation questionnaire, not an independent audit — but it asks the vendor to disclose and often document them, which lets a reviewing institution cross-check the vendor’s answers against externally verified evidence. For background on one of the certifications HECVAT commonly asks about, see ISO 27001 for Research Data Security.
Where HECVAT fits in the procurement workflow
In practice, a HECVAT review sits alongside — not instead of — the standard contracting and procurement steps a lab or department already follows. A typical sequence looks like:
- The lab or department identifies a vendor or tool it wants to procure (a cloud LIMS, survey platform, data-storage service, etc.).
- Procurement or IT security determines whether the engagement involves sensitive or regulated data and, if so, requires a HECVAT (Full, Lite, or On-Prem, depending on risk tier) as part of the vendor-review process.
- The vendor either completes the questionnaire directly or points the institution to an already-completed HECVAT in the Community Broker Index, where many vendors that serve higher education publish a current, ready-to-reuse assessment.
- The institution’s security/privacy office reviews the responses, flags gaps or follow-up questions, and issues a risk determination or set of required remediations before the contract proceeds.
- The completed HECVAT and any resulting risk decision typically get attached to the procurement or contract file, and may be revisited at renewal.
For federally funded research procurements specifically, this vendor-security review is a distinct step from — and doesn’t substitute for — the procurement standards a grant recipient must otherwise follow; see 2 CFR 200 Procurement Standards for what those require. It’s also worth confirming early whether the vendor relationship should be structured as a vendor/contractor purchase versus a subrecipient arrangement, since that affects which compliance obligations apply — see Subrecipient vs. Contractor vs. Vendor.
The Community Broker Index: why HECVAT saves time on both sides
One of HECVAT’s core design goals is reducing duplicate effort. Without a shared standard, a vendor selling into higher education might face a differently worded, differently scoped security questionnaire from every campus it works with, and every campus has to build and maintain its own. The Community Broker Index addresses this by giving vendors a place to publish a completed, current HECVAT that any subscribing institution can pull and review directly, rather than sending the vendor a fresh questionnaire from scratch. A vendor still needs to keep its published assessment current, and an institution can still ask follow-up or supplemental questions specific to its own risk tolerance, but the baseline work of answering the same core questions repeatedly is avoided.
Why this matters specifically for labs and research computing
Labs and research groups increasingly procure their own cloud tools — electronic lab notebooks, cloud-hosted LIMS, survey and data-collection platforms, AI/analysis tools that ingest research data — sometimes outside a formal central-IT purchasing process. That decentralization is exactly the scenario HECVAT was built to standardize: a lab evaluating a new SaaS tool for handling human-subjects data, unpublished research results, or other sensitive material should expect the same vendor-security review a central IT department would run, and HECVAT gives a lab’s procurement or security office a ready-made, higher-ed-specific way to do it without building a questionnaire from scratch. If a security incident does occur at a vendor after onboarding, the notification and reporting obligations that follow are a separate matter from HECVAT itself; see Data Security Incident Notification Requirements for what applies once a breach happens. For research relying on outside vendors more broadly — CROs, eClinical systems, or other clinical-trial vendors — see Clinical Trial Vendor Management.
Frequently asked questions
What is HECVAT?
HECVAT (Higher Education Community Vendor Assessment Toolkit) is a standardized security and privacy questionnaire that higher-education institutions use to evaluate third-party vendors, particularly cloud and SaaS providers, before procurement. It was developed by the HEISC Shared Assessments Working Group with Internet2 and REN-ISAC, and is now maintained through EDUCAUSE.
What is a HECVAT used for?
It’s used during vendor due diligence to standardize how an institution asks about, and a vendor discloses, its data security, privacy, and compliance practices — replacing one-off, institution-specific security questionnaires with a common, reusable format.
What is HECVAT Lite?
HECVAT Lite is the shortened version of the full HECVAT questionnaire, built from a subset of its highest-priority questions. Institutions use it for lower-risk vendor engagements where a full assessment would be disproportionate to the actual data-security exposure involved.
Does completing a HECVAT replace a SOC 2 or ISO 27001 audit?
No. HECVAT is a self-attestation questionnaire completed by the vendor, not an independent third-party audit. It typically asks whether the vendor holds certifications like SOC 2 or ISO/IEC 27001 and can supply supporting reports, so a reviewer can use those external attestations to verify what the vendor has disclosed.
Who has to complete a HECVAT — the vendor or the institution?
The vendor completes the HECVAT questionnaire. The purchasing institution’s security, privacy, or procurement office reviews the completed assessment and decides whether the vendor’s practices meet its risk tolerance before the purchase proceeds.
