Privacy and procurement
HECVAT
Higher Education Community Vendor Assessment Toolkit
The standard questionnaire institutions use to assess a vendor’s security, privacy and accessibility practices.
What it is
HECVAT is a standardised assessment developed by EDUCAUSE with Internet2 and REN-ISAC. More than 240 institutions have adopted it, which makes it the de facto vendor assessment in higher education.
HECVAT 4 consolidated what used to be three separate workbooks, Full, Lite and On-Premise, into a single workbook with conditional logic. Previously Lite ran to roughly 70 questions and Full to more than 250.
How it works
- One workbook
- A vendor completes the HECVAT 4 workbook covering security, privacy and accessibility practices, and keeps it current.
- Direct exchange
- Since the Community Broker Index was retired on 31 July 2025, institutions and vendors exchange completed assessments directly.
What PlannedQuest does
PlannedQuest maintains a completed, current HECVAT and sends it to institutions on request.
If your review needs it alongside our data privacy agreement, ask for both and we will send them together.