Why IT Asks Vendors for a HECVAT and VPAT

Buying software or a cloud service for your department? The Office of Innovation & Technology (OIT) will usually ask the vendor for two documents: a HECVAT and a VPAT. Here's what they are and why they matter.

What they are

SECURITY
HECVAT
The Higher Education Community Vendor Assessment Toolkit. A standard questionnaire, created by EDUCAUSE, where the vendor explains how they protect data: encryption, access, backups, breaches, and where data is stored.
ACCESSIBILITY
VPAT
The Voluntary Product Accessibility Template. The vendor's report on how well the product works for people with disabilities, measured against WCAG. The completed form is often called an ACR (Accessibility Conformance Report).

Why NCU asks for them

  • Protecting NCU data. NCU has to keep student records, employee information, and other university data safe under FERPA and NCU's Information Security policy, even when a vendor stores it.
  • Making sure everyone can use it. NCU follows WCAG 2.1 Level AA, so tools for students and employees need to work with screen readers, keyboards, and other assistive technology.
  • Comparing products fairly. Most higher-ed vendors already have these documents, so they're a quick, standard way to compare options.

How to keep your purchase on track

1

Talk to OIT early

Submit a request through Software Purchasing and Licensing (or Technology/Accessory Purchase Request for equipment) before you agree to anything with the vendor.
2

Ask the vendor for both documents

Ask your vendor contact for their current HECVAT and VPAT (or ACR), and attach them to your request. Most vendors can send them the same day.
3

Let OIT review

OIT reviews the documents and the contract, and follows up with you or the vendor if there are gaps.
4

Need NCU sign-in?

If the product should use your NCU account, include that too. See Single Sign-On (SSO) and Directory Services.

Don't sign first

Don't sign a contract, accept online terms, or enter NCU data into a new tool before OIT reviews it. It's much harder to fix problems after the fact.

Get help

Questions about a purchase? Submit a request through Software Purchasing and Licensing, call the IT Service Desk at 612.343.4170, or visit Miller Hall 226.

Print Article