HECVAT Security Assessment

1. Overview

The Higher Education Community Vendor Assessment Toolkit (HECVAT) is a standardized security assessment framework developed by the Higher Education Information Security Council (HEISC) and EDUCAUSE. It provides a consistent, comprehensive method for institutions to evaluate the security posture of third-party vendors and cloud service providers.

Ludwitt has completed both the HECVAT Lite (a streamlined assessment for lower-risk applications) and the HECVAT Full (the comprehensive 299-question assessment covering all security domains). These assessments demonstrate our commitment to meeting the security expectations of higher education institutions and ensuring that our platform meets the rigorous standards required for handling student data.

2. Assessment Summary

The following table summarizes Ludwitt's responses across all 16 HECVAT security domains. Each section has been thoroughly addressed with supporting documentation, policies, and technical evidence.

3. Key Findings Summary

4. Items Pending Third-Party Completion

While all HECVAT sections have been fully addressed, the following items depend on third-party engagements that are currently in progress:

• SOC 2 Type II Audit: Observation period is underway with all controls implemented. Formal audit and report issuance targeted for Q1 2027. See our Security Overview for the detailed roadmap.
• Annual Penetration Testing: Third-party penetration test is scheduled. Upon completion, the executive summary and remediation report will be available to institutional customers under NDA.
• 1EdTech LTI Certification: Ludwitt's LTI 1.3 Advantage implementation is complete and operational. Formal 1EdTech (formerly IMS Global) certification is in process, with an estimated timeline of 6–8 weeks.

5. How to Request the Full HECVAT

The complete HECVAT Full assessment — including all 299 questions, detailed responses, and supporting documentation — is available to institutional prospects and customers under a mutual Non-Disclosure Agreement (NDA).

To request the full document:

• Email security@ludwitt.com from your institutional email address.
• Include your institution name, your role, and the context for the request (e.g., procurement review, security assessment).
• We will respond within 2 business days with the NDA and full HECVAT document.

6. Related Documents

The following documents provide additional detail on the security, privacy, and compliance topics covered in the HECVAT assessment:

• Security Overview & SOC 2 Roadmap — Comprehensive security architecture, controls, and SOC 2 timeline
• Data Processing Agreement (DPA) — Contractual data protection commitments
• AI Transparency Statement — How AI is used in the platform, data handling, and bias mitigation
• Privacy Policy — Full privacy practices and data subject rights
• VPAT / Accessibility Statement — WCAG 2.1 AA conformance and accessibility commitments
• Student Privacy Policy — FERPA and COPPA-specific protections for student data
• LTI 1.3 Integration & LMS Compatibility — LMS integration capabilities and SSO support