HECVAT 4 for vendors: how to fill it in

If you sell software to a US college or university, sooner or later their IT security office will send you a HECVAT. This guide is for the vendor filling it in, not the university reviewing it.

What the HECVAT is

The HECVAT (Higher Education Community Vendor Assessment Toolkit) is a security questionnaire published by EDUCAUSE, the US higher-education IT association. Universities use it so that every vendor answers the same questions in the same Excel workbook, instead of each campus writing its own.

What changed in HECVAT 4

EDUCAUSE announced HECVAT 4 in February 2025. According to Campus Technology's report of the announcement:

• One file instead of three. The HECVAT Full, Lite and On-Prem versions were combined into one workbook that tells vendors which questions apply to their product.
• New AI questions. A set of AI-specific questions was added, written by community volunteers.
• Scoring on the institution's side. Institutional evaluation tabs let the university choose which categories count toward a product's score, and a "high risk" score gives a lighter-weight evaluation.

As of Salty Cloud's guide (updated May 15, 2026), the current release is 4.1.6, with 321 questions across seven main sections. You will rarely answer all of them; see the next section.

If a university sends you an older HECVAT 3 file (Full or Lite), ask whether they would accept version 4. Many guides online still describe version 3.

How the workbook decides what you answer

Per Salty Cloud's walkthrough, every vendor completes two parts:

1. Start Here, with eight required routing questions (REQU-01 to REQU-08) about your product: how it is deployed, what data it touches and so on.
2. Organization, questions about your company as a whole.

Your Start Here answers switch on the conditional sections that apply: Product, Infrastructure, IT accessibility, case-specific questions, Artificial Intelligence and Privacy. So the routing questions matter most. Answer them carefully. A wrong "Yes" there can add a whole section you don't need, and a wrong "No" can hide one the university expected.

How to fill it in, step by step

1. Confirm the version and deadline with the university. Ask whether they have a preferred format for attachments.
2. Gather your documents: security policy, access control, incident response, business continuity, data retention, privacy policy, accessibility statement (VPAT, if you have one), and any audit report or pen test summary.
3. Answer Start Here first, then let the workbook show you which sections to do.
4. Answer each row from evidence. For every Yes, you should be able to point to a sentence in a policy or a setting you could screenshot.
5. Use the explanation column for every No. "No. We do not hold a SOC 2 report. Our controls are documented in [policies], available under NDA. We plan to [step] by [date]." A short, true explanation helps the reviewer more than a stretched Yes.
6. Be careful with the AI section if your product uses AI. Describe what you actually do: which models, whether customer data is used for training, where it is processed. Don't describe aspirations as practice.
7. Keep the finished workbook. The same completed HECVAT can usually be shared with other institutions (Salty Cloud). Update it when your answers change, and date it.

Common mistakes

• Saying you are "HECVAT certified." There is no HECVAT certification. You completed a HECVAT. Salty Cloud makes the same point.
• Copying another vendor's answers. They describe someone else's controls.
• Leaving cells blank. A blank looks like an oversight. Write No or N/A and say why.
• Answering from intent. "We will encrypt backups" is a plan, not a Yes. See answering without SOC 2 for wording.

How Citesheet helps

We have measured Citesheet on the CAIQ only, not on the HECVAT, so we don't claim HECVAT support. If a university has sent you a HECVAT, you can send it with your policies and we'll tell you honestly how it does.