{"id":12947,"date":"2019-08-08T14:36:36","date_gmt":"2019-08-08T18:36:36","guid":{"rendered":"http:\/\/www.montclair.edu\/information-technology\/?page_id=12947"},"modified":"2025-09-16T16:05:32","modified_gmt":"2025-09-16T20:05:32","slug":"hecvat","status":"publish","type":"page","link":"https:\/\/www.montclair.edu\/information-technology\/security\/hecvat\/","title":{"rendered":"Vendor Assessment (HECVAT)"},"content":{"rendered":"

Return to Information Security Home<\/a><\/span><\/p>\n

A security review is required for all ÌÇÐÄvlog cloud and SaaS services<\/strong> that integrate with internal systems or collects, stores, and processes private data for University students, staff, alumni, parents, clients, or guests.<\/p>\n

Prior to the purchase, renewal, pilot program, or signing of a contract for a cloud service, it must pass a security review using the Higher Education Community Vendor Assessment Toolkit (HECVAT)<\/strong> to ensure it protects University data and meets compliance standards.<\/p>\n

Start your request now<\/strong>:<\/p>\n

Vendor Security Request<\/a> – This google form will help determine if a HECVAT review is required for the purchase. The form should be filled out by the department contact responsible for the purchase so Montclair IT can reach out directly with any questions.<\/p>\n

\n

<\/a>

What is a HECVAT<\/div>
\n

The HECVAT is a standardized security questionnaire developed specifically for higher education institutions to assist in evaluating a vendor\u2019s data protection practices, system security, and compliance with regulations such as FERPA<\/strong>, HIPAA<\/strong>, and PCI-DSS<\/strong>. The HECVAT is used by many higher education institutions and it is common for vendors to complete a HECVAT when requested to do so. Some vendors already have a HECVAT available by request.<\/p>\n

The HECVAT review ensures that vendors meet University security requirements, protect sensitive and confidential data, and comply with applicable laws. It helps safeguard University systems from risks like data breaches, service disruptions, and unauthorized access.<\/p>\n<\/div><\/div>\n

<\/a>

Who needs to complete this review<\/div>
\n

Any ÌÇÐÄvlog department planning to use a cloud or SaaS service<\/strong> for University business must fill out the form to see if a HECVAT review is required.<\/p>\n

This includes<\/strong> services for prospective and current students, faculty, staff, alumni, or any other constituents.<\/p>\n

You will need<\/strong><\/em> a HECVAT review if your procurement request matches any of the following questions:<\/p>\n