EDUCAUSE retired the Community Broker Index, the shared place where colleges could look up completed HECVATs, on 31 July 2025. Its FAQ says many of the assessments stored there had become outdated. The practical effect for vendors: your HECVAT now travels with your sales team, and an institution may ask for a fresh one if yours is stale.
If you sell software to colleges and universities, this is the questionnaire you will see most.
What's affected
HECVAT stands for Higher Education Community Vendor Assessment Toolkit. EDUCAUSE describes it as a questionnaire that lets college and university professionals evaluate third-party providers. Three details from the EDUCAUSE vendor FAQ matter most:
- One file. With HECVAT 4, the Full, Lite and On-Premise versions were rolled into one file. Solution providers complete all questions that apply to their product, as marked in the Required Questions section of the "Start Here" tab. An institution can then run a lite evaluation from your answers.
- New topics. HECVAT 4 added questions on privacy and AI. The FAQ also says IT accessibility and privacy are now key dimensions in procurement.
- Annual refresh. EDUCAUSE says solution providers should update their HECVAT at least once per year.
How to check if you're exposed
- Find the HECVAT you last sent. Open the "Start Here" tab and check the version number.
- If it was built on HECVAT 3, you will need to migrate. EDUCAUSE publishes a change log and migration document.
- Check the date. If it is more than twelve months old, treat it as expired.
- Look at the questions marked with an asterisk. EDUCAUSE says those are critical questions that carry the most weight in the score.
What to do now
- Download the current HECVAT 4 from EDUCAUSE. Using it as a vendor costs nothing, per the FAQ.
- Choose one owner. EDUCAUSE suggests whoever has the most complete knowledge of the product, passing sections to others as needed for security, infrastructure, privacy and accessibility.
- Answer every applicable question, and work the asterisked ones first.
- Use the comment fields to give scope and evidence, such as which data stores use encryption at rest.
- Add an IT accessibility answer you can support. If you have a VPAT or accessibility conformance report, reference it by name and date.
- Add privacy and AI answers: what data trains or feeds any model, whether customer data is used for training, and which subprocessors are involved.
- Save the completed file with the date in its name, and share it with anyone on your team who works with colleges.
Do not panic over a low score. The FAQ says your score is not complete until the institution has evaluated your answers against its own policies and appetite for risk.
How to avoid this trap
The trap is answering "yes" to everything to protect the score. Institutions compare your HECVAT with your contract, your SOC 2 report if you have one, and what their analyst finds on a call. An overstated answer costs more than a lower score.
A second trap is leaving the HECVAT as a one-time sales task. Put the annual update on the calendar and assign it to a named person, so it does not depend on whoever remembers.
EDUCAUSE also says most colleges and universities will accept a recent SOC 2 Type 2 report as a thorough review by an objective third-party auditor, and many will consider alternatives such as the CAIQ. If you have one of those, offer it alongside the HECVAT.
Why it matters
Higher education buyers often have small security teams and a long list of vendors. A complete, current, honest HECVAT lets them approve you without a long email thread. A stale or inflated one sends you to the back of the queue.
The addition of AI questions is the clearest signal of where reviews are heading. If your product uses AI features, write the answers now: which models, whether customer content leaves your environment, and whether it is retained.
Quick check
How many HECVAT files do vendors complete under version 4?
One. The Full, Lite and On-Premise versions were combined, and vendors complete the applicable questions.
How often should a vendor update its HECVAT?
At least once per year, according to EDUCAUSE.
Does a low score mean you are rejected?
No. The institution evaluates your answers against its own policies and risk appetite.
