Step 1. Choose your HECVAT Assessment


As campuses deploy or identify cloud services, they must ensure the cloud services are appropriately assessed for managing the risks to the confidentiality, integrity and availability of sensitive institutional information and the PII of constituents. The Higher Education Cloud Vendor Assessment Tool (HECVAT) attempts to generalize higher education information security and data protection questions and issues for consistency and ease of use. Some institutions may have specific issues that must be addressed in addition to the general questions provided in this assessment.

HECVAT Full v2.04 Assessment

A robust questionnaire for the assessment of a Third Party providing cloud services and resources by Higher Education Institutions.

HECVAT Lite v2.04 Assessment

A lightweight questionnaire for the assessment of a Third Party providing cloud services and resources by Higher Education Institutions.

HECVAT OnPrem v2.10 Assessment

Unique questionnaire used to evaluate on-premise appliances and software provided by a Third Party to Higher Education Institutions.

HECVAT Triage v2.10 Assessment

Special questionnaire to be completed by Higher Education Institutions. HECVAT Triage is a prerequisite for a risk assessment.

HECVAT was developed by HEISC Shared Assessments Working Group, in collaboration with Internet2 and REN-ISAC under a Creative Commons Attribution-Noncommercial-ShareAlike 4.0 International License.


Step 2. Edit / Answer / Share the Assessment


Disclaimer: the assessments are provided by Vendict “as is” for information purposes only. Any express or implied warranties, including, but not limited to, the implied warranties of merchantability and fitness for a particular purpose are disclaimed. While we endeavour to keep the information up to date and correct, we make no representations or warranties of any kind, express or implied, about the completeness, accuracy, reliability, suitability or availability with respect to the inserted assessment contained herein. Any reliance you place on such information is therefore strictly at your own risk.