What is HECVAT and how is Black Kite leveraging automation to transform the VRM process?
Written by: Black Kite
HECVAT stands for Higher Education Community Vendor Assessment Toolkit. It attempts to generalize higher education information security and data protections and issues for consistency and ease of use.
Of course, some institutions may have specific issues that must be addressed in addition to the general questions sets provided in the toolkit, however it is meant to address as many key questions as possible to ensure strong security. It is anticipated that the HECVAT will be revised over time to account for changes in services provisioning and the information security and data protection needs of higher education institutions.
HECVAT addresses a handful of needs for higher education institutions:
- Helps higher education institutions ensure that vendor services are appropriately assessed for security and privacy needs, including some that are unique to higher education
- Allows a consistent, easily-adopted methodology for campuses wishing to reduce costs through vendor services without increasing risks
- Reduces the burden that service providers face in responding to requests for security assessments from higher education institutions
How is Black Kite implementing HECVAT compliance automation in the Black Kite intelligence platform?
Black Kite automates the entire vendor risk management process including HECVAT compliance. HECVAT was created by the Higher Education Information Security Council (HEISC) Shared Assessments Working Group and was specifically designed for higher education to measure vendor risk.
Before working with a third-party vendor, the REN-ISAC recommends that organizations have vendors complete a HECVAT questionnaire. This confirms that information, data, and cybersecurity policies are in place to protect your sensitive institutional information and students’ PII.
Currently, Black Kite offers HECVAT Lite 3.03 for automatic compliance mapping in addition to full continuous monitoring of each third-party vendor.
HECVAT compliance levels are presented based on the correlation between Black Kite’s technical report and requirements from international standards such as ISO27001, NIST 800-53, NIST CSF, and PCI DSS 3.2.1.
Parse, analyze and map results to HECVAT controls in less than 30 seconds using Black Kite’s automated parser
Using the UniQuE Parser, upload vendor HECVAT questionnaires or any security policy documents to:
- Understand which HECVAT controls are met and which need more work
- Piece together existing gaps within the organization
- Compile Request for Information/Proposal (RFI/RFP) quickly, without having to review documents line-by-line
By exploring further past the dashboard in the platform, you can discover how each category and its findings map back to specific HECVAT controls and if information overlaps with other security frameworks.
