EDUCAUSE tells HECVAT vendors not to worry about a low score: its FAQ says the score "isn't complete until the institution has evaluated your answers against their own policies and appetite for risk". That one sentence describes how most reviewers work. A gap is not an automatic fail. An unexplained or overstated answer is.
This post gives you a way to answer when the honest answer is "not yet".
What's affected
Every small company hits the same questions before it has the control: no pen test yet, no SOC 2 report, no formal DR test, no SIEM. The temptation is to write "yes" because the practice exists informally, or to leave the cell blank. Both create risk. NIST's CSF 2.0 gives a better model: describe a current profile and a target profile, and characterize your rigor with Tiers, from Partial (Tier 1) to Adaptive (Tier 4). Reviewers understand "here is where we are and where we are going".
The five answer states
Use the same five words everywhere:
| State | Meaning | Sample wording |
|---|---|---|
| Yes | In place, tested, evidence available | "Yes. MFA is enforced for all staff on the identity provider, SSO, source control and cloud console. Evidence available on request." |
| Partly | In place for some scope | "Partly. Production databases are encrypted at rest. Developer laptops are encrypted on macOS, with Windows rollout finishing next quarter." |
| Planned | Not in place, dated plan exists | "Not yet. A third-party penetration test is scheduled for the next quarter, scoped to the web application and API. We can share the summary when complete." |
| Compensated | Different control meets the same goal | "We do not run a SIEM. Cloud audit logs are sent to central storage with alerts on defined events, reviewed by the on-call engineer." |
| No | Not in place, no plan | "No. We do not currently do this and do not plan to, because the risk it addresses does not apply to our product." |
"Not applicable" is a sixth state, and it needs a reason: "Not applicable, we do not process payment card data."
How to check if you're exposed
Scan your last questionnaire for answers that are really one of these:
- Blank cells or "see attached" with nothing attached.
- "Yes" where the true state is partly or planned.
- "Planned" with no date.
- "Compensated" with no description of the other control.
What to do now
- Sort every gap into one of the five states with an engineer. Do it before the questionnaire arrives.
- For each planned item, set a real date and an owner. Do not state a date you will miss.
- For each compensated item, write one sentence explaining why the other control meets the same goal.
- Prioritise closing gaps that recur across questionnaires. A control that three customers asked about is a roadmap item.
- Offer something in the meantime: a policy, a written procedure, an architecture note, or a call with the engineer who owns the area.
- Track commitments in a list and report progress to customers who asked.
Cheap controls to close first, drawn from NIST's small business guide: MFA on all accounts that offer it, automatic patching, backups with a tested restore, full-disk encryption, and a one page incident plan.
How to avoid this trap
The trap is turning "planned" into "yes" at the last minute. Customers sometimes ask for the evidence, and a missing artifact turns a small gap into a trust problem.
A second trap is over-explaining. State the state, one sentence of scope, and the evidence or date. A paragraph of excuses reads as worry.
A third is contradicting yourself across customers. Keep one master answer document and have one owner edit it, so a gap described to customer A is described the same way to customer B.
Why it matters
Most buyers do not expect small vendors to have everything. They expect honesty, a plan and follow-through. A company that says "partly, here is the date" and then meets the date earns more trust than one that claims everything and fails the first spot check.
Answers also sit in contracts. A wrong "yes" is a representation you signed. A "planned" with a date is a commitment you can keep.
Try it yourself
Take five questions from your last questionnaire where you answered "yes" with some hesitation. Re-answer them using the five states, and write the evidence or date next to each.
Click through it at your own pace, or open it full screen.
Quick check
What should every "Planned" answer include?
A real date and an owner, plus what will be shared when it is done.
When is "Not applicable" acceptable?
When you give the reason, for example that you do not process the type of data the control protects.
Does a low HECVAT score mean you fail?
No. EDUCAUSE says the score is not complete until the institution evaluates it against its own policies and risk appetite.
