HECVAT Lite for edtech startups: what HECVAT 4 asks

A university likes your product, and its IT security office asks for a HECVAT. Someone may have told you to look for the “HECVAT Lite”, the short version. This guide covers what the HECVAT is, what happened to the Lite, what the current file asks, where a small edtech company tends to get caught, and how long it takes. It draws on EDUCAUSE’s public material, cited at the end, and on our own judgment, which we label.

What the HECVAT is

The HECVAT is the Higher Education Community Vendor Assessment Toolkit: a questionnaire that colleges and universities use to assess technology vendors. EDUCAUSE says it was created by leaders in higher education in collaboration with EDUCAUSE, Internet2, and REN-ISAC, and calls it “the higher education sector’s preferred evaluation framework for selecting technology tools and services for campuses.” It asks about your cybersecurity, privacy, IT accessibility, and compliance in one file.

Four things about it are useful to know before you open it.

• It is free for you to use. EDUCAUSE makes HECVAT 4 available to college and university vendors for those business relationships at no cost and without a further license. Download it from EDUCAUSE’s HECVAT page.
• It describes your product, not one deal. EDUCAUSE says you can share a completed HECVAT with as many potential customers as you need without changing it, and should update it at least once a year.
• It stays an Excel file. EDUCAUSE says saving it in another format “renders it inoperable by the institution”, because the university scores it inside the workbook.
• Nobody hosts it for you now. The Community Broker Index, where completed HECVATs used to be listed, was retired on July 31, 2025. EDUCAUSE doesn’t collect completed files; you send yours to each school.

What happened to the HECVAT Lite

Earlier versions came in separate files: Full, Lite, and On-Premise. In HECVAT 4, EDUCAUSE says, those versions “have all been rolled into one”. Its own answer to “Where can I find the HECVAT Lite in version 4?” is that you complete every question that applies to your product or service, and “the institution can do a lite evaluation of your solution”.

The lite evaluation happens on the university’s side. Questions marked with an asterisk are critical: EDUCAUSE says they are the ones most important to institutions and carry the most weight in the score. For a lightweight review, which EDUCAUSE calls “similar to the HECVAT Lite in previous versions”, an analyst can score only those critical questions. EDUCAUSE’s instructions still say solution providers should always complete all applicable questions, so the institution can pick the review it wants.

What that means for you, in our reading: if a university asks for “the HECVAT Lite”, the current answer is a completed HECVAT 4 with every applicable question answered. If the school sent you a specific file, answer the file it sent, and ask whether it would also take a current HECVAT 4.

The version. EDUCAUSE’s HECVAT page listed 4.1.6 as the current version when we read it on October 6, 2026. EDUCAUSE revises the file and logs the changes, so check the page for the current version before you start.

What HECVAT 4 asks

Start on the Start Here tab. It asks for your company details, a few questions about your company, and eight required questions (REQU-01 to REQU-08) that decide which other tabs apply to you. In short, they ask whether you offer a cloud-based product, whether it has an interface, whether you provide consulting, whether it has AI features or will in the next 12 months, whether it handles health data covered by HIPAA, whether it handles card data, whether the school must run an appliance or open its firewall for you, and whether it can reach personal or institutional data, student data included. The Organization tab applies to every product.

Here is what each tab covers. The counts are ours, from the 4.1.6 file: questions with an ID, not counting the contact fields, with the critical ones in brackets. We didn’t find a total published by EDUCAUSE.

• Start Here: 13 (1 critical). Company background, whether you have dedicated development and security staff, and the eight required questions.
• Organization: 43 (12). Documentation (business continuity and disaster recovery plans, SOC 2, the security framework you follow, a privacy policy, onboarding and offboarding), how you assess third parties, change management, and your policies and procedures, patching included.
• Product: 41 (19). Authentication and accounts (single sign-on, federation, passwords, audit logs, multi-factor, session timeouts) and data (where it is stored, encryption in transit and at rest, and how it is handled).
• Infrastructure: 51 (17). Application security, hosting and data centers, firewalls and intrusion detection, incident handling, and vulnerability management.
• IT Accessibility: 18 (4). An accessibility contact, your accessibility conformance report (VPAT or ACR), conformance to WCAG 2.1 AA, and how you track and fix accessibility issues.
• Case-Specific: 60 (11). Consulting, HIPAA, PCI DSS, and on-premises software. These apply only if your required answers say so.
• AI: 31 (16). AI governance, policy, data security, machine learning, and large language models, if your product has AI features or plans them.
• Privacy: 65 (10). Which privacy laws reach your data (FERPA first, then GDPR and state laws), sensitive data, privacy policies and procedures, international transfers, data privacy, and AI’s use of institutional data.

That is 322 questions in all, 90 of them critical. You answer only the ones that apply. Suppose a cloud product holds student data, has no AI, health, or card data, and installs nothing on campus. If Start Here, Organization, Product, Infrastructure, IT Accessibility, and Privacy apply in full, that is about 230 questions. Add AI features and it is about 260. Some questions inside a tab are follow-ups that may not apply to you, so your number may be lower.

Leave the tabs titled “Evaluation” and the Analyst Notes column alone: they are the university’s. The file’s instructions also say that if you leave an answer blank, you must say why in the Additional Information column.

Where small edtech teams get caught

These come from reading the questions against how a small software company usually runs. They are our judgment, not survey data.

• Single sign-on and federation. Universities run their own identity systems. The Product tab asks whether you support single sign-on (AAAI-01), which web standards you support, such as SAML2, OIDC, or CAS (AAAI-15), whether you belong to InCommon or another eduGAIN-affiliated federation (AAAI-06), and whether the school can map attributes such as eduPerson (AAAI-13). If you support only Google sign-in today, say exactly that.
• FERPA. The Privacy tab opens by asking whether your product processes FERPA-related data (PRGN-01). If students or instructors use it, answer from what data you actually hold and why, and take the legal reading from your own counsel, not from a questionnaire guide.
• Accessibility. Four critical questions ask whether you have a VPAT or ACR made or updated in the past 12 months (ITAC-06), whether you will commit to an accessibility standard in the contract (ITAC-07), whether the product substantially conforms to WCAG 2.1 AA (ITAC-08), and whether you track accessibility issues (ITAC-09). These need facts from whoever builds your interface. If you have no conformance report, say so and give your plan; don’t claim conformance nobody has checked.
• Plans that are “tested annually”. Two critical questions ask for a documented business continuity plan and a documented disaster recovery plan, each with an owner and tested every year (DOCU-01, DOCU-02). Many small teams have backups and no written, tested plan. Say which one you have.
• Your SOC 2 versus your host’s. One question asks whether you have had a SOC 2 audit (DOCU-03). Another asks whether a SOC 2 Type 2 report exists for the hosting environment (DCTR-02). Your cloud provider’s report answers the second, not the first.
• AI on the roadmap counts. The required question on AI (REQU-04) covers features planned for the next 12 months, so a planned feature opens the AI tab.
• A planned control written as a live one. If it isn’t running today, say “not yet” and give the date. Our guide to answering when a control is missing covers how to write that answer.

How a university reads it

The workbook scores you. Each answer is compared with a compliant response chosen by the HECVAT’s volunteers, some questions weigh more than others, and the critical ones weigh most. The university can then switch categories on or off (PCI DSS, for example, if it won’t use your payment feature), override a compliant response or an importance level, and mark questions as non-negotiable.

On a low score, EDUCAUSE’s own words are: “Your score isn’t complete until the institution has evaluated your answers against their own policies and appetite for risk.” In our judgment, that is the case for an honest “No” with a clear explanation in Additional Information. An analyst can override a “No” they understand. A “Yes” that falls apart on the first follow-up question is harder to recover from. Every institution sets its own threshold, so nobody can promise you a result.

Three more points from EDUCAUSE:

• Other documents. “Most colleges and universities will accept a recent SOC2 Type 2 report”, and many will consider alternatives such as the CAIQ (our guide to SIG Lite and CAIQ-Lite covers that one). Sales literature is no substitute for either.
• NDAs. Asked whether you can require an NDA before an institution sees your HECVAT, EDUCAUSE answers that the HECVAT is not meant to collect confidential information, and recommends redacting anything you consider confidential.
• Who answers. EDUCAUSE expects the file may pass between several people to answer the cybersecurity, infrastructure, privacy, and accessibility questions accurately.

How long it takes

We have no measured average, so here is our arithmetic instead, the same as in our SIG Lite guide. At about three minutes a question, 230 questions is roughly eleven and a half hours of writing. That estimate is ours, not a benchmark.

As with any questionnaire, the writing is the short part. The HECVAT spreads its facts wider than most: accessibility answers come from whoever builds the interface, privacy answers from whoever owns the privacy notice, and hosting answers from engineering. Plan on several calendar days if those are different people. Four things help:

1. Answer the eight required questions first, then list the tabs that apply before you write anything else.
2. Do the critical questions first. They weigh most, and they are what a lightweight review reads.
3. Gather the documents the file asks you to link or describe: your privacy notice (PRGN-05), an accessibility statement or VPAT (ITAC-05), an architecture diagram with data flows (DOCU-05), and your incident response plan (HFIH-01). If customers keep asking for the same facts, a security overview document collects them in one place.
4. Keep the finished file. EDUCAUSE expects an update at least once a year, and the next school can get the same file.

If you would rather hand it off

Blank Slate Creative, LLC answers vendor security questionnaires, the HECVAT included. We do readiness and documentation work only: never an audit, an attestation, or a certification. This guide draws on EDUCAUSE’s public material and our own judgment, not client work.

A full HECVAT 4 runs past the 175 questions our flat-price questionnaire order covers, so we quote it. Tell us which tabs your required answers open, and when the file is due, and ask for a quote. If the university sent a shorter sheet of its own, 175 questions or fewer, the questionnaire order covers it: up to 125 questions is $85, and up to 175 is $130.

You give us the facts, and we write answers that match how you actually operate, gaps included. We read each completed questionnaire before it is sent to you. We won’t write an answer for a control you don’t run, and we can’t promise a university will approve. We don’t test your product for accessibility or write a VPAT or ACR; the accessibility answers come from what your team tells us.

Sources

All read on 2026-10-06. EDUCAUSE revises the HECVAT, so check the current version.

• EDUCAUSE, Higher Education Community Vendor Assessment Toolkit (who created the HECVAT and what it covers, current version 4.1.6, the license terms for vendors).
• EDUCAUSE, HECVAT FAQs for Corporations (the “preferred evaluation framework” line, versions rolled into one, where the Lite went, critical questions and scoring, yearly updates, SOC 2 and CAIQ, NDAs, Excel only, the Community Broker Index).
• EDUCAUSE, How to Use the HECVAT (the Start Here tab and required questions, the evaluation tabs, the lightweight review of critical questions).
• Nichole Arbino and Nick Lewis, HECVAT 4: Better than Ever, EDUCAUSE Review, February 10, 2025 (what changed in version 4).
• EDUCAUSE, HECVAT 4.1.6 workbook (the tabs, question IDs, and file instructions; the question counts are ours, counted in this file).