Vendor Risk Review (HECVAT/VPAT)

Overview

All software, web applications, cloud tools, and digital services acquired or used by Montclair State University must undergo a technical vendor review prior to purchase, contract renewal, pilot testing, or agreement signing.

Quick Facts:

  • Review Turnaround Time: 5 to 10 business days once all completed vendor documents are submitted.
  • Mandatory Policy: Do not sign contracts, make payments, or launch trials/pilots until official approval is granted.
  • Individual Use Exemption: Software with accounts created directly on a vendor site without NetID login, system integration, or University data do not require a security review.

Required Vendor Documents:

  • HECVAT 4 Excel Workbook (Cybersecurity): Evaluates system safety to protect University data from security breaches, unauthorized access, and cyber threats. (Higher Education Community Vendor Assessment Toolkit).
  • VPAT Conformance Report (Digital Accessibility): Evaluates the software interface to ensure it is usable by everyone, including individuals with disabilities or those using assistive technology. (Voluntary Product Accessibility Template).

Ready to Submit?

How to Request a Vendor Review

  1. Do You Need a Review?

    A vendor review is required if your software or service matches ANY of the following criteria:

    • Montclair Login (Single Sign-On / SSO): Users sign in using their standard Montclair NetID and password.
    • Handles Non-Public University Data: The software stores, processes, or views confidential records:
      • Student Data (FERPA): Class rosters, grades, course assignments, or student IDs.
      • Personal Data (PII): Social Security numbers, home addresses, payroll, or personnel files.
      • Health Data (HIPAA): Student or employee medical and health records.
      • Financial Data: Official University accounting, banking, or budget details.
    • Processes Payments: Collects or processes credit card payments.
    • System Connections (APIs or Database Syncing): Automatically syncs data with internal Montclair databases or systems.
    • Artificial Intelligence (AI): Includes AI features, chatbots, or automated assistants (e.g., ChatGPT integrations, Copilots, or ML writing tools).
    • Widespread Campus Access: Will be used for teaching, research, or daily operations by students, faculty, staff, or alumni.

  2. Obtain Vendor Files & Review Policy

    Contact your vendor to request their compliance files prior to starting the form:

    Reassessments and Renewals:

    • Legacy HECVAT 3.x Files: If a vendor provides a HECVAT 3.x completed for another university within the last 2 years, it remains acceptable.
    • Software Renewals: Security approvals are valid for 2 years. A new review is only required upon renewal if the vendor changed, new AI features were added, or the data classification level increased.

    Note: If a vendor refuses or cannot provide compliance files, contact Information Security directly to discuss alternative risk options.

  3. Review Process

    1. Request Files: Obtain the completed VPAT and HECVAT Excel file from your vendor.
    2. Submit Form: Fill out our online intake form and upload the vendor's files (3 to 5 minutes)
    3. IT & Accessibility Review: Information Security and Digital Accessibility evaluate technical controls and ADA compliance.
    4. Receive Decision: You will receive an official decision email.

    Note: This review covers technical security and accessibility only. Contract language and terms are reviewed separately by University Counsel and Procurement.

    Documentation Already Ready? Access Our Vendor Risk Review Form