HECVAT (Higher Education Community Vendor Assessment Toolkit) is the security and privacy questionnaire US higher-education institutions use to evaluate third-party providers before purchase. It is maintained by EDUCAUSE with Internet2 and REN-ISAC and is the de facto vendor-review artifact for college and university procurement.
What changed in HECVAT 4?
HECVAT 4 launched in January 2025 and folded the Full, Lite, and On-Premise variants into a single questionnaire with new privacy and AI questions.
Per EDUCAUSE Review's HECVAT 4 announcement, the redesign consolidates earlier variants into one toolkit and adds questions on AI use and privacy practices. The old model had institutions pick a version matching the vendor's deployment or risk tier; HECVAT 4 flexes to those scenarios via in-form filtering. Past v3 versions (the v3.04 family) still circulate at some campuses during the transition.
Who maintains HECVAT and why does it matter?
HECVAT was built by EDUCAUSE, Internet2, and REN-ISAC volunteers and is now embedded in many universities' procurement workflows for cloud and SaaS.
The toolkit is free and hosted on the EDUCAUSE HECVAT page. Completed HECVATs also flow through the Cloud Broker Index and AWS Artifact, so a vendor who fills one out cleanly can satisfy many campuses without re-answering. Most universities flow HECVAT down as a standard step in IT procurement above a data-sensitivity threshold.
Why does HECVAT show up alongside the SIG?
If you sell SaaS to a US college or university, expect a HECVAT alongside or in place of a SIG. Many institutions will not contract without one.
The two questionnaires overlap heavily but a SIG answer set will not answer the HECVAT verbatim. Most teams selling into higher ed keep a HECVAT response cache mirroring their SIG and CAIQ caches, refreshed against the same SOC 2 cycle. The work fits inside the TPRM motion vendors already run for enterprise customers.
Related terms
These adjacent terms cover the questionnaire and audit artifacts a HECVAT review will trigger and the broader vendor-review motion it lives in.
- SIG - the Shared Assessments questionnaire most enterprise buyers send; HECVAT is its higher-ed analog
- CAIQ - the Cloud Security Alliance questionnaire that overlaps with HECVAT for SaaS vendors
- TPRM - the vendor-review discipline HECVAT lives inside on the buyer side
- VRM - the IT-vendor risk slice that owns most HECVAT response work day to day