HECVAT Security Assessment

1. Overview

The Higher Education Community Vendor Assessment Toolkit (HECVAT) is a standardized security assessment framework developed by the Higher Education Information Security Council (HEISC) and EDUCAUSE. It provides a consistent, comprehensive method for institutions to evaluate the security posture of third-party vendors and cloud service providers.

Ludwitt has completed both the HECVAT Lite (a streamlined assessment for lower-risk applications) and the HECVAT Full (the comprehensive 299-question assessment covering all security domains). These assessments demonstrate our commitment to meeting the security expectations of higher education institutions and ensuring that our platform meets the rigorous standards required for handling student data.

2. Assessment Summary

The following table summarizes Ludwitt's responses across all 16 HECVAT security domains. Each section has been thoroughly addressed with supporting documentation, policies, and technical evidence.

3. Key Findings Summary

4. Third-Party Assessments

While all HECVAT sections have been fully addressed, Ludwitt has not completed these third-party assessments:

• SOC 2 Type II Audit: Planned. No auditor is engaged yet, and Ludwitt holds no SOC 2 report; controls are tested internally. See our Security Overview for details.
• Penetration Testing: Performed internally with automated agents; no third-party test is scheduled.
• 1EdTech LTI Certification: Ludwitt implements LTI 1.3 Advantage but is not 1EdTech (formerly IMS Global) certified and has not applied for certification.

5. How to Request the Full HECVAT

The complete HECVAT Full assessment — including all 299 questions, detailed responses, and supporting documentation — is available to institutional prospects and customers under a mutual Non-Disclosure Agreement (NDA).

To request the full document:

• Email security@ludwitt.com from your institutional email address.
• Include your institution name, your role, and the context for the request (e.g., procurement review, security assessment).
• We will respond within 2 business days with the NDA and full HECVAT document.

6. Related Documents

The following documents provide additional detail on the security, privacy, and compliance topics covered in the HECVAT assessment:

• Security Overview & SOC 2 Roadmap — Comprehensive security architecture, controls, and SOC 2 status
• Data Processing Agreement (DPA) — Contractual data protection commitments
• AI Transparency Statement — How AI is used in the platform, data handling, and bias mitigation
• Privacy Policy — Full privacy practices and data subject rights
• VPAT / Accessibility Statement — WCAG 2.1 AA conformance and accessibility commitments
• Student Privacy Policy — FERPA and COPPA-specific protections for student data
• LTI 1.3 Integration & LMS Compatibility — LMS integration capabilities and SSO support