HECVAT for SaaS vendors selling to universities: a practical guide

Selling software to a college or university? Sooner or later, their IT security office will ask you to complete a HECVAT. It is the standard security questionnaire of higher education in the United States, and many institutions won’t move forward without one.

What the HECVAT is

HECVAT stands for Higher Education Community Vendor Assessment Toolkit. It was created by leaders in higher education together with EDUCAUSE, Internet2 and REN-ISAC, and EDUCAUSE owns the copyright. It covers cybersecurity, privacy, IT accessibility and compliance in one workbook.

EDUCAUSE makes it available at no cost to colleges and universities and to the vendors that work with them, for those business relationships. You can download the current version from the EDUCAUSE website.

What changed in HECVAT 4

Earlier versions came in separate Full, Lite and On-Premise files. HECVAT 4, released in 2025, combines them into one file that guides you to the questions that apply to your product. It also added a set of privacy questions and new questions about artificial intelligence.

If an institution sends you an older version, it is fine to ask whether they would accept HECVAT 4 instead, but answer the version they ask for.

How to complete it

1. Start with the instructions and scoping questions. They decide which sections apply to your product and how it is deployed.
2. Gather your documents first: security policy, privacy policy, subprocessor list, incident response plan, and any audit reports or penetration test summaries.
3. Prepare for the higher-education topics. Expect questions about accessibility (for example, whether you have accessibility documentation such as a VPAT) and, if you handle student records, about FERPA, the US law that protects them.
4. Answer literally and honestly. Where you don’t meet a control, say so and explain what you do instead.
5. Have one person read the whole workbook at the end for consistency before it goes back.
6. Save it. Other institutions will ask for the same questionnaire, and a completed, current HECVAT shortens every later review.

Tips from the vendor side

• Don’t rebuild the workbook. Fill in the file you received; institutions often score or import it.
• Be careful with new AI questions. Describe exactly what your product does with AI and with institutional data, and nothing more.
• Keep a list of what you promised. Commitments made in a HECVAT can end up in the contract.
• If you don’t have a SOC 2 report, say so plainly (see how to answer the SOC 2 question).

Answering a HECVAT with Rendro

Rendro drafts answers from your own documents, shows the source for each, flags what your documents don’t cover, and writes the answers back into the original workbook, leaving its formulas and dropdowns alone. Approved answers are saved, so the next institution’s HECVAT starts mostly done.