Hello,
I am being asked by more and more colleges and universities for a Higher Education Community Vendor Assessment Toolkit (HECVAT) before they will allow us to survey their students using Qualtrics software. Someone at Qualtrics completed an HECVAT for me in December 2019. I'm wondering if anyone has successfully acquired a more recent HECVAT from Qualtrics? I'm especially wondering if any of the 100+ IHE's (https://docs.google.com/document/d/1ACX6fly0c3gPm_KA9bMZ2xJ8BKHrEFryuBD08NC_7BM/edit) in the Coalition that use HECVAT also have Qualtrics accounts needed an HECVAT from Qualtrics before signing their contracts?
It could very well be due to security concerns, but to date, Qualtrics is not one of the vendors who are willing to share their completed HECVAT here: https://www.ren-isac.net/hecvat/cbi.html
I'm wondering how schools that require an HECVAT for all solution providers and are also Qualtrics customers have been dealing with this requirement. More info is below.
Thanks in advance,
Mary Hoban
American College Health Association
For more info: https://library.educause.edu/resources/2020/4/higher-education-community-vendor-assessment-toolkit
What is the HECVAT?
For Colleges and Universities—The HECVAT is a questionnaire framework specifically designed for higher education to measure vendor risk. Before you purchase a third-party solution, ask the solution provider to complete a HECVAT tool to confirm that information, data, and cybersecurity policies are in place to protect your sensitive institutional information and constituents' PII.
For Solution Providers—Complete the assessment tool and share it in the Cloud Broker Index. Once completed, your assessment can be used by multiple institutions to streamline procurement processes with your higher ed clients.
