What Is HECVAT?
HECVAT (Higher Education Cloud Vendor Assessment Tool) is a standardized security questionnaire developed by the higher education community. It contains over 200 questions covering the security and compliance posture of cloud vendors — ensuring they meet the standards required to handle CMC's institutional data.
HECVAT covers:
- Data privacy and security practices
- Data encryption at rest and in transit
- User access controls and identity management
- Incident response and breach notification capabilities
- Compliance with FERPA, GLBA, and HIPAA (where applicable)
- Vendor business continuity and disaster recovery
All educational technology vendors must complete HECVAT before CMC will enter a purchase agreement. This requirement protects student data, institutional records, and CMC's legal compliance posture.
Risk Assessment Levels
After reviewing the completed HECVAT, our team assigns a risk level based on the data the vendor will handle and the strength of their security controls.
Approved Quickly
Data will not include student, financial, or personnel records. Usually approved within a few business days.
Additional Review
Data may include internal or sensitive information. Requires compensating controls and deeper analysis (1-2 weeks additional).
Executive Approval
Data includes restricted info — SSNs, health records, financial aid. Requires executive sign-off and enhanced security measures.
Before You Submit
Vendor Name and Website
The full legal name of the vendor company and their official product website.
Product Description
What does the software do? Who at CMC will use it and for what purpose?
Intended Use Case
What data will the vendor access or process? Include data types (student records, financial, HR, etc.).
Vendor HECVAT Response
If available, attach the vendor's completed HECVAT questionnaire to speed up the review.
Contract / Pricing Docs
Share any draft contract, data processing agreement, or pricing documentation from the vendor.
Procurement Timeline
When do you need to make a purchasing decision? Allow at least 2-3 weeks for the HECVAT review process.
Vendor Submission
Vendor receives and completes the HECVAT questionnaire
ITS Review
Solutions & Security teams evaluate against CMC data requirements
Risk Assessment
Low / Medium / High risk level assigned based on data sensitivity
Decision
Approved, Approved with Conditions, or Denied — documented for compliance
Common Pitfalls to Avoid
-
Starting Too Late
Begin the HECVAT process before committing to a vendor or signing any agreement. Reviews typically take 2-3 weeks. Do not wait until the last minute.
-
Incomplete Vendor Responses
Ensure the vendor answers all HECVAT questions thoroughly. Incomplete responses trigger a back-and-forth cycle that significantly delays the review.
-
Underestimating Data Sensitivity
If the software will handle student data, grades, or financial records — even peripherally — assume Medium or High risk and plan your timeline accordingly.
Submit a Vendor for Review
Complete the form below to initiate a HECVAT security review. Our team will respond within one business day.
Frequently Asked Questions
HECVAT reviews typically take 2-3 weeks from the time the vendor submits a complete questionnaire. Reviews of high-risk vendors may take longer due to the need for additional documentation and executive approval. Plan accordingly when setting your procurement timeline.
The vendor is responsible for completing the HECVAT questionnaire accurately. ITS reviews the vendor's completed responses and assesses them against CMC's security and compliance requirements. Your role is to initiate the process and ensure the vendor responds promptly.
An "Approved with Conditions" outcome means the vendor can be used, but specific security controls must be implemented first — such as data encryption requirements, restricted access controls, or contractual data processing agreements. ITS will work with you and the vendor to define and verify these conditions before any data is shared.
If any CMC institutional data — including student information, employee records, or financial data — will be entered into or processed by the software, HECVAT is required regardless of whether the software is free or in a trial phase. Data risk does not disappear because there is no cost involved.