Attachment C - HECVAT.xlsx

XLSX spreadsheet 836 KB Posted Oct 8, 2025

Attached to: Request for Proposal for Moran Eye Center Refraction System
Solicitation number: 08262025MC
Issued by: Salt Lake County, Utah

About this file

Written by GovTribe AI · Oct 8, 2025

This is a Higher Education Community Vendor Assessment Toolkit (HECVAT) Version 4.02 file developed by EDUCAUSE, a comprehensive cybersecurity and privacy assessment document designed for higher education institutions to evaluate technology vendors. The document is a standardized Excel-based assessment that covers multiple dimensions of vendor security, including company information, documentation, third-party management, change management, authentication, data handling, infrastructure, accessibility, AI capabilities, and privacy practices.

The HECVAT provides a detailed, multi-tab framework for vendors to disclose their security and privacy practices across critical areas such as single sign-on protocols, data encryption, intrusion detection, vulnerability management, HIPAA and PCI DSS compliance, and AI risk models. The toolkit is structured with critical, standard, and minor importance questions that allow institutions to comprehensively assess a vendor's technological, operational, and ethical safeguards. Vendors are expected to provide extensive documentation and transparency about their security processes, with specific emphasis on protecting institutional data, managing third-party risks, implementing secure development practices, and maintaining robust privacy controls.

View the file

Other files

File	Type	Posted
Attachment A - Minimum Mandatory Requirements.xlsx	XLSX spreadsheet	Oct 8, 2025
RFP #08262025MC.pdf	PDF	Oct 8, 2025
Attachment B - Cost Proposal.xlsx	XLSX spreadsheet	Oct 8, 2025

On GovTribe

Work with this file

Download the original file
Contacts named in this file
Similar government files
Ask GovTribe AI about this file

Try for free Login

Text version

The file's text, extracted by GovTribe without its formatting.

START HERE

Cells contained in this worksheet may contain cells with dropdown lists as well as autopopulated formulas.
HECVAT™ Solution Provider Response - Start Here					Version 4.02
Date Completed
Instructions for Solution Providers
1. Complete the "Start Here" tab and review the "Required Questions" guidance to find the other sections are required for your product or service.
2. Complete the "Organization" tab and the applicable questions in each of the next 5 tabs (Product through Privacy) that apply, based on your answers to the "Required Questions."
3. Guidance in column E may change based on your answers to prompt details in "Additional Information." If leaving an answer blank, you must also state why in "Additional Information".
4. DO NOT complete any fields in the "Evaluation" sheets or the "Analyst Notes" column.
5. Return the completed file to institutions.
* Denotes critical questions. Critical questions are those deemed most important to institutions by higher education volunteers.
For full instructions, please visit educause.edu/HECVAT
General Information
GNRL-01	Solution Provider Name
GNRL-02	Solution Name
GNRL-03	Solution Description
GNRL-04	Solution Provider Contact Name
GNRL-05	Solution Provider Contact Title
GNRL-06	Solution Provider Contact Email
GNRL-07	Solution Provider Contact Phone Number
GNRL-08	Country of Company Headquarters
GNRL-09	Employee Work Locations (all)
Company Information		Answer	Additional Information	Guidance	Analyst Notes
COMP-01	Do you have a dedicated software and system development team(s) (e.g., customer support, implementation, product management, etc.)?*
COMP-02	Describe your organization’s business background and ownership structure, including all parent and subsidiary relationships.			Include circumstances that may involve offshoring or multinational agreements.
COMP-03	Have you operated without unplanned disruptions to this solution in the past 12 months?
COMP-04	Do you have a dedicated information security staff or office?
COMP-05	Use this area to share information about your environment that will assist those who are assessing your company's data security program.			Share any details that would help information security analysts assess your solution.		End Table Data
Required Questions		Answer	Additional Information	Guidance	Analyst Notes
REQU-01	Are you offering either a product or platform, as opposed to only offering a service
REQU-02	Does your product or service have an interface?			This includes any interface for end users and interfaces used by administrators at the institution.
REQU-03	Are you providing consulting services?
REQU-04	Does your solution have AI features, or are there plans to implement AI features in the next 12 months?
REQU-05	Does your solution process protected health information (PHI) or any data covered by the Health Insurance Portability and Accountability Act (HIPAA)?			Answer "yes" if your solution handles personal health information (PHI), either directly or via a third party.
REQU-06	Is the solution designed to process, store, or transmit credit card information?			Answer yes if your solution handles PCI (credit card) information, either directly or via a third party.
REQU-07	Does operating your solution require the institution to operate a physical or virtual appliance in their own environment or to provide inbound firewall exceptions to allow your employees to remotely administer systems in the institution's environment?
REQU-08	Does your solution have access to personal or institutional data?			This includes patient data, student data, employment data, human research data, financial data, etc.		End Table Data
Note: The "Organization" tab is required for ALL products and services.
Copyright © 2025 EDUCAUSE

&"Helvetica,Regular"&12&K000000 &P http://www.educause.edu/HECVAT Organization

Cells contained in this worksheet may contain cells with dropdown lists as well as autopopulated formulas.
HECVAT Solution Provider Response - Organization					Version 4.02
Date Completed		12/31/1899
Instructions for Solution Providers
1. Complete the "Start Here" tab and review the "Required Questions" guidance to find the other sections are required for your product or service.
2. Complete the "Organization" tab and the applicable questions in each of the next 5 tabs (Product through Privacy) that apply, based on your answers to the "Required Questions."
3. Guidance in column E may change based on your answers to prompt details in "Additional Information." If leaving an answer blank, you must also state why in "Additional Information".
4. DO NOT complete any fields in the "Evaluation" sheets or the "Analyst Notes" column.
5. Return the completed file to institutions.
* Denotes critical questions. Critical questions are those deemed most important to institutions by higher education volunteers.
For full instructions, please visit educause.edu/HECVAT
General Information		Answer
GNRL-01	Solution Provider Name
GNRL-02	Solution Name
GNRL-03	Solution Description
GNRL-04	Solution Provider Contact Name
GNRL-05	Solution Provider Contact Title
GNRL-06	Solution Provider Contact Email
GNRL-07	Solution Provider Contact Phone Number
GNRL-08	Country of Company Headquarters
Documentation		Answer	Additional Information	Guidance	Analyst Notes
DOCU-01	Do you have a well-documented business continuity plan (BCP), with a clear owner, that is tested annually?*
DOCU-02	Do you have a well-documented disaster recovery plan (DRP), with a clear owner, that is tested annually?*
DOCU-03	Have you undergone a SSAE 18/SOC 2 audit?
DOCU-04	Do you conform with a specific industry standard security framework (e.g., NIST Cybersecurity Framework, CIS Controls, ISO 27001, etc.)?
DOCU-05	Can you provide overall system and/or application architecture diagrams, including a full description of the data flow for all components of the system?
DOCU-06	Does your organization have a data privacy policy?
DOCU-07	Do you have a documented, and currently implemented, employee onboarding and offboarding policy?					End Table Data
Assessment of Third Parties		Answer	Additional Information	Guidance	Analyst Notes
THRD-01	Do you perform security assessments of third-party companies with which you share data (e.g., hosting providers, cloud services, PaaS, IaaS, SaaS)?*
THRD-02	Do you have contractual language in place with third parties governing access to institutional data?*			List each third party and why institutional data is shared with them. Format example: [Third Party Name] - Reason
THRD-03	Do the contracts in place with these third parties address liability in the event of a data breach?*
THRD-04	Do you have an implemented third-party management strategy?*			Robust answers from the solution provider improve the quality and efficiency of the security assessment process.
THRD-05	Do you have a process and implemented procedures for managing your hardware supply chain (e.g., telecommunications equipment, export licensing, computing devices)?			Make sure you address any national or regional regulations.		End Table Data
Change Management		Answer	Additional Information	Guidance	Analyst Notes
CHNG-01	Will the institution be notified of major changes to your environment that could impact the institution's security posture?*
CHNG-02	Does the system support client customizations from one release to another?*			Ensure that all relevant details pertaining to CHNG-06 are clearly stated in your response.
CHNG-03	Do you have an implemented system configuration management process (e.g.,secure "gold" images, etc.)?*
CHNG-04	Do you have a documented change management process?
CHNG-05	Does your change management process minimally include authorization, impact analysis, testing, and validation before moving changes to production?
CHNG-06	Does your change management process verify that all required third-party libraries and dependencies are still supported with each major change?
CHNG-07	Do you have policy and procedure, currently implemented, managing how critical patches are applied to all systems and applications?
CHNG-08	Have you implemented policies and procedures that guide how security risks are mitigated until patches can be applied?
CHNG-09	Do clients have the option to not participate in or postpone an upgrade to a new release?
CHNG-10	Do you have a fully implemented solution support strategy that defines how many concurrent versions you support?			List the current version you support and what percentage of customers are utilizing that version.
CHNG-11	Do you have a release schedule for product updates?
CHNG-12	Do you have a technology roadmap, for at least the next two years, for enhancements and bug fixes for the solution being assessed?
CHNG-13	Can solution updates be completed without institutional involvement (i.e., technically or organizationally)?
CHNG-14	Are upgrades or system changes installed during off-peak hours or in a manner that does not impact the customer?
CHNG-15	Do procedures exist to provide that emergency changes are documented and authorized (including after-the-fact approval)?
CHNG-16	Do you have a systems management and configuration strategy that encompasses servers, appliances, cloud services, applications, and mobile devices (company and employee owned)?					End Table Data
Policies, Processes, and Procedures		Answer	Additional Information	Guidance	Analyst Notes
PPPR-01	Do you have a documented patch management process?*
PPPR-02	Can your organization comply with institutional policies on privacy and data protection with regard to users of institutional systems, if required?*
PPPR-03	Is your company subject to the institution's geographic region's laws and regulations?*			State the country that governs and regulates your company.
PPPR-04	Can you accommodate encryption requirements using open standards?
PPPR-05	Do you have a documented systems development life cycle (SDLC)?
PPPR-06	Do you perform background screenings or multi-state background checks on all employees prior to their first day of work?
PPPR-07	Do you require new employees to fill out agreements and review policies?
PPPR-08	Do you have a documented information security policy?
PPPR-09	Are information security principles designed into the product lifecycle?
PPPR-10	Will you comply with applicable breach notification laws?
PPPR-11	Do you have an information security awareness program?
PPPR-12	Is security awareness training mandatory for all employees?
PPPR-13	Do you have process and procedure(s) documented, and currently followed, that require a review and update of the access list(s) for privileged accounts?
PPPR-14	Do you have documented, and currently implemented, internal audit processes and procedures?
PPPR-15	Does your organization have physical security controls and policies in place?					End Table Data
Copyright © 2025 EDUCAUSE

ERROR:#REF!

&"Helvetica,Regular"&12&K000000 &P

Product

Cells contained in this worksheet may contain cells with dropdown lists as well as autopopulated formulas.
HECVAT Solution Provider Response - Product					Version 4.02
Date Completed		12/31/1899
Instructions for Solution Providers
1. Complete the "Start Here" tab and review the "Required Questions" guidance to find the other sections are required for your product or service.
2. Complete the "Organization" tab and the applicable questions in each of the next 5 tabs (Product through Privacy) that apply, based on your answers to the "Required Questions."
3. Guidance in column E may change based on your answers to prompt details in "Additional Information." If leaving an answer blank, you must also state why in "Additional Information".
4. DO NOT complete any fields in the "Evaluation" sheets or the "Analyst Notes" column.
5. Return the completed file to institutions.
* Denotes critical questions. Critical questions are those deemed most important to institutions by higher education volunteers.
For full instructions, please visit educause.edu/HECVAT
General Information		Answer
GNRL-01	Solution Provider Name
GNRL-02	Solution Name
GNRL-03	Solution Description
GNRL-08	Country of Company Headquarters
Required Questions		Answer		Guidance	Analyst Notes
REQU-01	Are you offering either a product or platform, as opposed to only offering a service					End Table Data
Authentication, Authorization, and Account Management		Answer	Additional Information	Guidance	Analyst Notes
AAAI-01	Does your solution support single sign-on (SSO) protocols for user and administrator authentication?*			Answer "yes" only if user AND administrator authentication is supported. If partially supported, answer "no." Ensure you respond to any guidance in the Additional Information column.
AAAI-02	Does your solution support local authentication protocols for user and administrator authentication?*
AAAI-03	Can you enforce password/passphrase complexity requirements (provided by the institution)?*
AAAI-04	Does the system have password complexity or length limitations and/or restrictions?*			Answer "yes" if your solution has internal limits to password complexity (max langth, certain special characters unsupported, etc.).
AAAI-05	Do you have documented password/passphrase reset procedures that are currently implemented in the system and/or customer support?*
AAAI-06	Does your organization participate in InCommon or another eduGAIN-affiliated trust federation?*
AAAI-07	Are there any passwords/passphrases hard-coded into your systems or solutions?*
AAAI-08	Are you storing any passwords in plaintext?*
AAAI-09	Are audit logs available that include AT LEAST all of the following: login, logout, actions performed, and source IP address?*
AAAI-10	Describe or provide a reference to the (a) system capability to log security/authorization changes, as well as user and administrator security events (i.e., physical or electronic), such as login failures, access denied, changes accepted; and (b) all requirements necessary to implement logging and monitoring on the system. Include (c) information about SIEM/log collector usage.*			Ensure that all elements of AAAI-10 are clearly stated in your response.
AAAI-11	Can you provide the institution documentation regarding the retention period for those logs, how logs are protected, and whether they are accessible to the customer (and if so, how)?*			Ensure that all elements of AAAI-11 are clearly stated in your response.
AAAI-12	Does your application support integration with other authentication and authorization systems?
AAAI-13	Do you allow the customer to specify attribute mappings for any needed information beyond a user identifier? (e.g., Reference eduPerson, ePPA/ePPN/ePE)
AAAI-14	Does your application support directory integration for user accounts?
AAAI-15	Does your solution support any of the following web SSO standards: SAML2 (with redirect flow), OIDC, CAS, or other?			An answer of "yes" should be well-supported in the Additional Information column, and all elements of interest should be sufficiently addressed.
AAAI-16	Do you support differentiation between email address and user identifier?
AAAI-17	If you don't support SSO, does your application and/or user frontend/portal support multifactor authentication (e.g., Duo, Google Authenticator, OTP, etc.)?
AAAI-18	Does your application automatically lock the session or log out an account after a period of inactivity?					End Table Data
Data		Answer	Additional Information	Guidance	Analyst Notes
DATA-01	Will the institution's data be stored on any devices (database servers, file servers, SAN, NAS, etc.) configured with non-RFC 1918/4193 (i.e., publicly routable) IP addresses?*
DATA-02	Is the transport of sensitive data encrypted using security protocols/algorithms (e.g., system-to-client)?*
DATA-03	Is the storage of sensitive data encrypted using security protocols/algorithms (e.g., disk encryption, at-rest, files, and within a running database)?*
DATA-04	Do all cryptographic modules in use in your solution conform to the Federal Information Processing Standards (FIPS PUB 140-2 or 140-3)?*
DATA-05	Will the institution's data be available within the system for a period of time at the completion of this contract?*
DATA-06	Are these rights retained even through a provider acquisition or bankruptcy event?*
DATA-07	Do backups containing the institution's data ever leave the institution's data zone either physically or via network routing?*
DATA-08	Is media used for long-term retention of business data and archival purposes stored in a secure, environmentally protected area?*
DATA-09	At the completion of this contract, will data be returned to the institution and/or deleted from all your systems and archives?			Please specify if it will be returned, deleted, or both.
DATA-10	Can the institution extract a full or partial backup of data?
DATA-11	Do current backups include all operating system software, utilities, security software, application software, and data files necessary for recovery?
DATA-12	Are you performing off-site backups (i.e., digitally moved off site)?
DATA-13	Are physical backups taken off-site (i.e., physically moved off site)?
DATA-14	Are data backups encrypted?
DATA-15	Do you have a media handling process that is documented and currently implemented that meets established business needs and regulatory requirements, including end-of-life, repurposing, and data-sanitization procedures?
DATA-16	Does the process described in DATA-15 adhere to DoD 5220.22-M and/or NIST SP 800-88 standards?
DATA-17	Does your staff (or third party) have access to institutional data (e.g., financial, PHI, or other sensitive information) through any means?
DATA-18	Do you have a documented and currently implemented strategy for securing employee workstations when they work remotely (i.e., not in a trusted computing environment)?
DATA-19	Does the environment provide for dedicated single-tenant capabilities? If not, describe how your solution or environment separates data from different customers (e.g., logically, physically, single tenancy, multi-tenancy).
DATA-20	Are ownership rights to all data, inputs, outputs, and metadata retained by the institution?
DATA-21	In the event of imminent bankruptcy, closing of business, or retirement of service, will you provide 90 days for customers to get their data out of the system and migrate applications?
DATA-22	Are involatile backup copies made according to predefined schedules and securely stored and protected?			Ensure that response addresses involatile storage and lists retention periods.
DATA-23	Do you have a cryptographic key management process (generation, exchange, storage, safeguards, use, vetting, and replacement) that is documented and currently implemented, for all system components (e.g., database, system, web, etc.)?			Summarize your cryptographic key management process.		End Table Data
Copyright © 2025 EDUCAUSE

ERROR:#REF!

&"Helvetica,Regular"&12&K000000 &P

Infrastructure

Cells contained in this worksheet may contain cells with dropdown lists as well as autopopulated formulas.
HECVAT Solution Provider Response - Infrastructure					Version 4.02
Date Completed		12/31/1899
Instructions for Solution Providers
1. Complete the "Start Here" tab and review the "Required Questions" guidance to find the other sections are required for your product or service.
2. Complete the "Organization" tab and the applicable questions in each of the next 5 tabs (Product through Privacy) that apply, based on your answers to the "Required Questions."
3. Guidance in column E may change based on your answers to prompt details in "Additional Information." If leaving an answer blank, you must also state why in "Additional Information".
4. DO NOT complete any fields in the "Evaluation" sheets or the "Analyst Notes" column.
5. Return the completed file to institutions.
* Denotes critical questions. Critical questions are those deemed most important to institutions by higher education volunteers.
For full instructions, please visit educause.edu/HECVAT
General Information		Answer
GNRL-01	Solution Provider Name
GNRL-02	Solution Name
GNRL-03	Solution Description
GNRL-08	Country of Company Headquarters
Required Questions		Answer		Guidance	Analyst Notes
REQU-01	Are you offering either a product or platform, as opposed to only offering a service					End Table Data
Application/Service Security		Answer	Additional Information	Guidance	Analyst Notes
APPL-01	Are access controls for institutional accounts based on structured rules, such as role-based access control (RBAC), attribute-based access control (ABAC), or policy-based access control (PBAC)?*			This includes end users, administrators, service accounts, etc. PBAC would include various dynamic controls such as conditional access, risk-based access, location-based access, or system activity–based access.
APPL-02	Are you using a web application firewall (WAF)?*
APPL-03	Are only currently supported operating system(s), software, and libraries leveraged by the system(s)/application(s) that will have access to institution's data?*			If the web application only works with a subset of modern supported browsers, please indicate that here.
APPL-04	Does your application require access to location or GPS data?
APPL-05	Does your application provide separation of duties between security administration, system administration, and standard user functions?*
APPL-06	Do you subject your code to static code analysis and/or static application security testing prior to release?*
APPL-07	Do you have software testing processes (dynamic or static) that are established and followed?*
APPL-08	Are access controls for staff within your organization based on structured rules, such as RBAC, ABAC, or PBAC?			This includes system administrators and third-party personnel with access to the system. PBAC would include various dynamic controls such as conditional access, risk-based access, location-based access, or system activity–based access.
APPL-09	Does the system provide data input validation and error messages?
APPL-10	Do you have a process and implemented procedures for managing your software supply chain (e.g., libraries, repositories, frameworks, etc.)			Include any in-house developed or contract development.
APPL-11	Have your developers been trained in secure coding techniques?
APPL-12	Was your application developed using secure coding techniques?
APPL-13	If mobile, is the application available from a trusted source (e.g., App Store, Google Play Store)?			Select N/A if there is no mobile version of your app.
APPL-14	Do you have a fully implemented policy or procedure that details how your employees obtain administrator access to institutional instance of the application?					End Table Data
Datacenter		Answer	Additional Information	Guidance	Analyst Notes
DCTR-01	Select your hosting option.			If you are using an option not listed, or a combination of options, select "Other." Your selection here will determine which questions below are required.
DCTR-02	Is a SOC 2 Type 2 report available for the hosting environment?
DCTR-03	Are you generally able to accommodate storing each institution's data within its geographic region?
DCTR-04	Are the data centers staffed 24 hours a day, seven days a week (i.e., 24 x 7 x 365)?
DCTR-05	Are your servers separated from other companies via a physical barrier, such as a cage or hard walls?
DCTR-06	Does a physical barrier fully enclose the physical space, preventing unauthorized physical contact with any of your devices?*
DCTR-07	Are your primary and secondary data centers geographically diverse?
DCTR-08	Is the service hosted in a high-availability environment?
DCTR-09	Is redundant power available for all data centers where institutional data will reside?
DCTR-10	Are redundant power strategies tested?*
DCTR-11	Does the center where the data will reside have cooling and fire-suppression systems that are active and regularly tested?
DCTR-12	Do you have Internet Service Provider (ISP) redundancy?
DCTR-13	Does every data center where the institution's data will reside have multiple telephone company or network provider entrances to the facility?
DCTR-14	Do you require multifactor authentication for all administrative accounts in your environment?
DCTR-15	Are you using your cloud provider's available hardening tools or pre-hardened images?
DCTR-16	Does your cloud solution provider have access to your encryption keys?
Firewalls, IDS, IPS, and Networking		Answer	Additional Information	Guidance	Analyst Notes
FIDP-01	Are you utilizing a stateful packet inspection (SPI) firewall?*
FIDP-02	Do you have a documented policy for firewall change requests?*
FIDP-03	Have you implemented an intrusion detection system (network-based)?*
FIDP-04	Do you employ host-based intrusion detection?*
FIDP-05	Are audit logs available for all changes to the network, firewall, IDS, and IPS systems?*
FIDP-06	Is authority for firewall change approval documented? Please list approver names or titles in Additional Info.
FIDP-07	Have you implemented an intrusion prevention system (network-based)?
FIDP-08	Do you employ host-based intrusion prevention?
FIDP-09	Are you employing any next-generation persistent threat (NGPT) monitoring?
FIDP-10	Is intrusion monitoring performed internally or by a third-party service?			In addition to stating your intrusion monitoring strategy, provide a brief summary of its implementation.
FIDP-11	Do you monitor for intrusions on a 24 x 7 x 365 basis?					End Table Data
Incident Handling		Answer	Additional Information	Guidance	Analyst Notes
HFIH-01	Do you have a formal incident response plan?
HFIH-02	Do you either have an internal incident response team or retain an external team?
HFIH-03	Do you have the capability to respond to incidents on a 24 x 7 x 365 basis?
HFIH-04	Do you carry cyber-risk insurance to protect against unforeseen service outages, data that is lost or stolen, and security incidents?					End Table Data
Vulnerability Management		Answer	Additional Information	Guidance	Analyst Notes
VULN-01	Are your systems and applications scanned with an authenticated user account for vulnerabilities (that are remediated) prior to new releases?*
VULN-02	Will you provide results of application and system vulnerability scans to the institution?*
VULN-03	Will you allow the institution to perform its own vulnerability testing and/or scanning of your systems and/or application, provided that testing is performed at a mutually agreed upon time and date?*
VULN-04	Have your systems and applications had a third-party security assessment completed in the last year?
VULN-05	Do you regularly scan for common web application security vulnerabilities (e.g., SQL injection, XSS, XSRF, etc.)?			Ensure that all elements of VULN-05 are clearly stated in your response.
VULN-06	Are your systems and applications regularly scanned externally for vulnerabilities?					End Table Data
Copyright © 2025 EDUCAUSE

ERROR:#REF!

&"Helvetica,Regular"&12&K000000 &P http://www.educause.edu/HECVAT IT Accessibility

Cells contained in this worksheet may contain cells with dropdown lists as well as autopopulated formulas.
HECVAT Solution Provider Response - IT Accessibility					Version 4.02
Date Completed		12/31/1899
Instructions for Solution Providers
1. Complete the "Start Here" tab and review the "Required Questions" guidance to find the other sections are required for your product or service.
2. Complete the "Organization" tab and the applicable questions in each of the next 5 tabs (Product through Privacy) that apply, based on your answers to the "Required Questions."
3. Guidance in column E may change based on your answers to prompt details in "Additional Information." If leaving an answer blank, you must also state why in "Additional Information".
4. DO NOT complete any fields in the "Evaluation" sheets or the "Analyst Notes" column.
5. Return the completed file to institutions.
* Denotes critical questions. Critical questions are those deemed most important to institutions by higher education volunteers.
For full instructions, please visit educause.edu/HECVAT
General Information		Answer
GNRL-01	Solution Provider Name
GNRL-02	Solution Name
GNRL-03	Solution Description
GNRL-08	Country of Company Headquarters
Required Questions		Answer		Guidance	Analyst Notes
REQU-02	Does your product or service have an interface?			This includes any interface for end users and interfaces used by administrators at the institution.		End Table Data
IT Accessibility		Answer	Additional Information	Guidance	Analyst Notes
ITAC-01	Solution Provider Accessibility Contact Name
ITAC-02	Solution Provider Accessibility Contact Title
ITAC-03	Solution Provider Accessibility Contact Email
ITAC-04	Solution Provider Accessibility Contact Phone Number
ITAC-05	Web Link to Accessibility Statement or VPAT			VPAT can also be added as an attachment
ITAC-06	Has a VPAT or ACR been created or updated for the solution and version under consideration within the past 12 months?*			If your answer is “I do not know,” select “no.” If the VPAT/ACR is for an older version of the product or has not been updated, its information does not accurately reflect the accessibility of the product under consideration and the response should be "no." Provide a link or attachment to the most recent VPAT/ACR.
ITAC-07	Will your company agree to meet your stated accessibility standard or WCAG 2.1 AA as part of your contractual agreement for the solution?*
ITAC-08	Does the solution substantially conform to WCAG 2.1 AA?*			Solutions "substantially conform" if they entirely meet WCAG 2.1 AA or if almost all user and administrator features conform. Documentation about limitations and/or workarounds should be provided where WCAG conformance is not presently achieved. If the solution substantially conforms to a newer standard such as WCAG 2.2 AA, answer "yes."
ITAC-09	Do you have a documented and implemented process for reporting and tracking accessibility issues?*			Reporting and fixing accessibility issues is critical to a mature process. If the process for this question is merely a "feature request" and tracker, the answer to this question should be "no."
ITAC-10	Do you have documentation to support the accessibility features of your solution?			If specific configurations, settings, themes, author guides, or instructions are needed to ensure accessibility, are instructions on how to do so provided for administrators and end users?
ITAC-11	Has a third-party expert conducted an audit of the most recent version of your solution?			Audit results, including VPAT/ACRs, are voluntary reports often generated by the creator of the product. Audits conducted and reports generated by expert third parties give greater confidence to customers.
ITAC-12	Do you have a documented and implemented process for verifying accessibility conformance?
ITAC-13	Have you adopted a technical or legal standard of conformance for the solution?			Various federal and state governments in the United States and around the world have mandated accessibility technical requirements that should be considered and may be required when selling solutions to institutions in these jurisdictions.
ITAC-14	Can you provide a current, detailed accessibility roadmap with delivery timelines?			A detailed accessibility roadmap should reference improvements and progress on known accessibility issues as appropriate but does not necessarily need to list unreleased product features.
ITAC-15	Do you expect your staff to maintain a current skill set in IT accessibility?			How do you ensure that your professional staff keeps current with digital accessibility laws and best practices? Is your staff able to evaluate and test this product with assistive technologies such as a screen reader or alternative input devices? Examples of staff certification may include IAAP certifications <https://www.accessibilityassociation.org/s/professional-certifications> or §508 Trusted Tester <https://www.dhs.gov/trusted-tester>.
ITAC-16	Do you have documented processes and procedures for implementing accessibility into your development lifecycle?			Describe where accessibility falls in the development and product lifecycle. Is it at the beginning of your project development or after the product is otherwise complete before launch? Do you incorporate accessibility in your development methods, such as Agile scrums? Does your customer-facing accessibility reporting match your development processes (i.e., Agile methods are best represented using a roadmap and timeline; revised VPAT/ACRs provide a snapshot in time of a given release)?
ITAC-17	Can all functions of the application or service be performed using only the keyboard?
ITAC-18	Does your product rely on activating a special "accessibility mode," a "lite version," or using an alternate interface (including “overlay” or AI-based alternates) for accessibility purposes?			Third-party overlays or add-ons are not sufficient for products to conform with accessibility standards. If there is an accessibility mode, does it address a specific accessibility need? Are plans in place to remove the accessible version, and are these distinctions delineated on your roadmap and timeline?		End Table Data
Copyright © 2025 EDUCAUSE

ERROR:#REF!

&"Helvetica,Regular"&12&K000000 &P http://www.educause.edu/HECVAT Case-Specific

Cells contained in this worksheet may contain cells with dropdown lists as well as autopopulated formulas.
HECVAT Solution Provider Response - Case-Specific Questions					Version 4.02
Date Completed		12/31/1899
Instructions for Solution Providers
1. Complete the "Start Here" tab and review the "Required Questions" guidance to find the other sections are required for your product or service.
2. Complete the "Organization" tab and the applicable questions in each of the next 5 tabs (Product through Privacy) that apply, based on your answers to the "Required Questions."
3. Guidance in column E may change based on your answers to prompt details in "Additional Information." If leaving an answer blank, you must also state why in "Additional Information".
4. DO NOT complete any fields in the "Evaluation" sheets or the "Analyst Notes" column.
5. Return the completed file to institutions.
* Denotes critical questions. Critical questions are those deemed most important to institutions by higher education volunteers.
For full instructions, please visit educause.edu/HECVAT
General Information		Answer
GNRL-01	Solution Provider Name
GNRL-02	Solution Name
GNRL-03	Solution Description
GNRL-08	Country of Company Headquarters
Required Questions		Answer	Additional Information	Guidance	Analyst Notes
REQU-03	Are you providing consulting services?
REQU-05	Does your solution process protected health information (PHI) or any data covered by the Health Insurance Portability and Accountability Act (HIPAA)?			Answer "yes" if your solution handles personal health information (PHI), either directly or via a third party.
REQU-06	Is the solution designed to process, store, or transmit credit card information?			Answer yes if your solution handles PCI (credit card) information, either directly or via a third party.
REQU-07	Does operating your solution require the institution to operate a physical or virtual appliance in their own environment or to provide inbound firewall exceptions to allow your employees to remotely administer systems in the institution's environment?					End Table Data
Consulting Services		Answer	Additional Information	Guidance	Analyst Notes
CONS-01	Will the consultant require access to the institution's network resources?*
CONS-02	Has the consultant received training on (sensitive, HIPAA, PCI, etc.) data handling?*
CONS-03	Is the data encrypted (at rest) while in the consultant's possession?*
CONS-04	Can access be restricted based on source IP address?*
CONS-05	Will the consulting take place on-premises?
CONS-06	Will the consultant require access to hardware in the institution's data centers?
CONS-07	Will the consultant require an account within the institution's domain (@*.edu)?
CONS-08	Will any data be transferred to the consultant's possession?
CONS-09	Will the consultant need remote access to the institution's network or systems?					End Table Data
HIPAA Compliance		Answer	Additional Information	Guidance	Analyst Notes
HIPA-01	Do your workforce members receive regular training related to the Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security Rules and the HITECH Act?*			Refer to HIPAA regulations documentation for supplemental guidance in this section.
HIPA-02	Have you identified areas of risk?*			Refer to HIPAA regulations documentation for supplemental guidance in this section.
HIPA-03	Have the relevant policies/plans been tested?*			Refer to HIPAA regulations documentation for supplemental guidance in this section.
HIPA-04	Have you entered into a Business Associate Agreements with all subcontractors who may have access to protected health information (PHI)?*			Refer to HIPAA regulations documentation for supplemental guidance in this section.
HIPA-05	Do you monitor or receive information regarding changes in HIPAA regulations?			Refer to HIPAA regulations documentation for supplemental guidance in this section.
HIPA-06	Has your organization designated HIPAA Privacy and Security officers as required by the rules?			Refer to HIPAA regulations documentation for supplemental guidance in this section.
HIPA-07	Do you comply with the requirements of the Health Information Technology for Economic and Clinical Health Act (HITECH)?			Refer to HIPAA regulations documentation for supplemental guidance in this section.
HIPA-08	Have you conducted a risk analysis as required under the HIPAA Security Rule?			Refer to HIPAA regulations documentation for supplemental guidance in this section.
HIPA-09	Have you taken actions to mitigate the identified risks?			Refer to HIPAA regulations documentation for supplemental guidance in this section.
HIPA-10	Does your application require user and system administrator password changes at a frequency no greater than 90 days?			Refer to HIPAA regulations documentation for supplemental guidance in this section.
HIPA-11	Does your application require users to set their own password after an administrator reset or on first use of the account?			Refer to HIPAA regulations documentation for supplemental guidance in this section.
HIPA-12	Does your application lock out an account after a number of failed login attempts?			Refer to HIPAA regulations documentation for supplemental guidance in this section.
HIPA-13	Does your application automatically lock or log-out an account after a period of inactivity?			Refer to HIPAA regulations documentation for supplemental guidance in this section.
HIPA-14	Are passwords visible in plain text, whether when stored or entered, including service level accounts (i.e., database accounts, etc.)?			Refer to HIPAA regulations documentation for supplemental guidance in this section.
HIPA-15	If the application is institution-hosted, can all service level and administrative account passwords be changed by the institution?			Refer to HIPAA regulations documentation for supplemental guidance in this section.
HIPA-16	Does your application provide the ability to define user access levels?			Refer to HIPAA regulations documentation for supplemental guidance in this section.
HIPA-17	Does your application support varying levels of access to administrative tasks defined individually per user?			Refer to HIPAA regulations documentation for supplemental guidance in this section.
HIPA-18	Does your application support varying levels of access to records based on user ID?			Refer to HIPAA regulations documentation for supplemental guidance in this section.
HIPA-19	Is there a limit to the number of groups to which a user can be assigned?			Refer to HIPAA regulations documentation for supplemental guidance in this section.
HIPA-20	Do accounts used for solution provider-supplied remote support abide by the same authentication policies and access logging as the rest of the system?			Refer to HIPAA regulations documentation for supplemental guidance in this section.
HIPA-21	Does the application log record access including specific user, date/time of access, and originating IP or device?			Refer to HIPAA regulations documentation for supplemental guidance in this section.
HIPA-22	Does the application log administrative activity, such as user account access changes and password changes, including specific user, date/time of changes, and originating IP or device?			Refer to HIPAA regulations documentation for supplemental guidance in this section.
HIPA-23	How long does the application keep access/change logs?			Refer to HIPAA regulations documentation for supplemental guidance in this section.
HIPA-24	Can the application logs be archived?			Refer to HIPAA regulations documentation for supplemental guidance in this section.
HIPA-25	Can the application logs be saved externally?			Refer to HIPAA regulations documentation for supplemental guidance in this section.
HIPA-26	Do you have a disaster recovery plan and emergency mode operation plan?			Refer to HIPAA regulations documentation for supplemental guidance in this section.
HIPA-27	Can you provide a HIPAA compliance attestation document?			Refer to HIPAA regulations documentation for supplemental guidance in this section.
HIPA-28	Are you willing to enter into a Business Associate Agreement (BAA)?			Refer to HIPAA regulations documentation for supplemental guidance in this section.
HIPA-29	Do your data backup and retention policies and practices meet HIPAA requirements?			Refer to HIPAA regulations documentation for supplemental guidance in this section.		End Table Data
Payment Card Industry Data Security Standard (PCI DSS)		Answer	Additional Information	Guidance	Analyst Notes
PCID-01	Do you have a current, executed within the past year, Attestation of Compliance (AoC) or Report on Compliance (RoC)?*			Refer to PCI DSS Security Standards for supplemental guidance in this section
PCID-02	Is the application listed as an approved Payment Application Data Security Standard (PA-DSS) application?*			Refer to PCI DSS Security Standards for supplemental guidance in this section
PCID-03	Does the system or solutions use a third party to collect, store, process, or transmit cardholder (payment/credit/debt card) data?*			Refer to PCI DSS Security Standards for supplemental guidance in this section
PCID-04	Do your systems or solutions store, process, or transmit cardholder (payment/credit/debt card) data?			Refer to PCI DSS Security Standards for supplemental guidance in this section
PCID-05	Are you compliant with the Payment Card Industry Data Security Standard (PCI DSS)?			Refer to PCI DSS Security Standards for supplemental guidance in this section
PCID-06	Are you classified as a service provider?			Refer to PCI DSS Security Standards for supplemental guidance in this section
PCID-07	Are you on the list of Visa approved service providers?			Refer to PCI DSS Security Standards for supplemental guidance in this section
PCID-08	Are you classified as a merchant? If so, what level (1, 2, 3, 4)?			Refer to PCI DSS Security Standards for supplemental guidance in this section
PCID-09	Describe the architecture employed by the system to verify and authorize credit card transactions.			Refer to PCI DSS Security Standards for supplemental guidance in this section
PCID-10	What payment processors/gateways does the system support?			Refer to PCI DSS Security Standards for supplemental guidance in this section
PCID-11	Can the application be installed in a PCI DSS–compliant manner?			Refer to PCI DSS Security Standards for supplemental guidance in this section
PCID-12	Include documentation describing the system's abilities to comply with the PCI DSS and any features or capabilities of the system that must be added or changed in order to operate in compliance with the standards.			Refer to PCI DSS Security Standards for supplemental guidance in this section		End Table Data
On-Premises Data Solutions		Answer	Additional Information	Guidance	Analyst Notes
OPEM-01	Do you support role-based access control (RBAC) for system administrators?
OPEM-02	Can your employees access customer systems remotely?
OPEM-03	Can you provide overall system and/or application architecture diagrams including a full description of the data communications architecture for all components of the system?
OPEM-04	Do you require remote management of the system?
OPEM-05	Are your remote actions and changes logged or otherwise visible to the campus? (IF YES to OPAP-06)
OPEM-06	If you maintain remote access to the system, will you handle data in a FERPA-compliant manner?
OPEM-07	Do you support campus status monitoring through SNMPv3 or other means?
OPEM-08	Describe or provide a reference to any other safeguards used to monitor for malicious activity.			Please detail your monitoring strategy
OPEM-09	Describe how long your organization has conducted business in this area.			Include the number of years and in what capacity.
OPEM-10	Do you have existing higher education customers?					End Table Data
Copyright © 2025 EDUCAUSE

ERROR:#REF!

&"Helvetica,Regular"&12&K000000 &P http://www.educause.edu/HECVAT

Cells contained in this worksheet may contain cells with dropdown lists as well as autopopulated formulas.
HECVAT Solution Provider Response - AI					Version 4.02
Date Completed		12/31/1899
Instructions for Solution Providers
1. Complete the "Start Here" tab and review the "Required Questions" guidance to find the other sections are required for your product or service.
2. Complete the "Organization" tab and the applicable questions in each of the next 5 tabs (Product through Privacy) that apply, based on your answers to the "Required Questions."
3. Guidance in column E may change based on your answers to prompt details in "Additional Information." If leaving an answer blank, you must also state why in "Additional Information".
4. DO NOT complete any fields in the "Evaluation" sheets or the "Analyst Notes" column.
5. Return the completed file to institutions.
* Denotes critical questions. Critical questions are those deemed most important to institutions by higher education volunteers.
For full instructions, please visit educause.edu/HECVAT
General Information		Answer
GNRL-01	Solution Provider Name
GNRL-02	Solution Name
GNRL-03	Solution Description
GNRL-08	Country of Company Headquarters
Required Questions		Answer	Additional Information	Guidance	Analyst Notes
REQU-04	Does your solution have AI features, or are there plans to implement AI features in the next 12 months?					End Table Data
AI Qualifying Questions		Answer	Additional Information	Guidance	Analyst Notes
AIQU-01	Does your solution leverage machine learning (ML) or do you plan to do so in the next 12 months?			Trigger for ML Questions
AIQU-02	Does your solution leverage a large language model (LLM) or do you plan to do so in the next 12 months?			Trigger for LLM Questions		End Table Data
General AI Questions		Answer	Additional Information	Guidance	Analyst Notes
AIGN-01	Does your solution have an AI risk model when developing or implementing your solution's AI model?*			Examples include AI RMF, OWASP Top 10, RAFT, MITRE ATLAS.
AIGN-02	Can your solution's AI features be disabled by tenant and/or user?*			Looking for granular access for and ability to disable AI-related features.
AIGN-03	Have your staff completed responsible AI training?*			Provide the responsible AI training provided to your staff and its frequency.
AIGN-04	Please describe the capabilities of your solution's AI features.			Looking for the capabilities, use-case, goals, and benefits of the AI model or feature(s).
AIGN-05	Does your solution support business rules to protect sensitive data from being ingested by the AI model?			Looking for business rules, model assertions, or prediction limiters to mitigate exposure of senstive data through model inputs.		End Table Data
AI Policy		Answer	Additional Information	Guidance	Analyst Notes
AIPL-01	Are your AI developer's policies, processes, procedures, and practices across the organization related to the mapping, measuring, and managing of AI risks conspicuously posted, unambiguous, and implemented effectively?*			Looking for responsible AI development policies and practices.
AIPL-02	Have you identified and measured AI risks?*			Looking for documentation and policies around measuring AI risk.

This is the start of the file's text. The full file is on GovTribe.

File details come from the government source that posted it. Updated Oct 8, 2025.