What is the K-12CVAT?
For K-12 Schools and Districts
- The CoSN K-12 Community Vendor Assessment Tool or K-12CVAT, is a questionnaire framework specifically designed for K-12 schools, districts and education service districts to measure vendor risk. Before you purchase a third-party solution, ask the solution provider to complete a K-12CVAT tool to confirm that information, data, and cybersecurity policies are in place to protect your sensitive school system information and constituents’ PII. It is recommended that you use the K-12CVAT as part of procurement processes, including having potential solution providers complete the questionnaire as part of RFP processes and purchase evaluations.
For K-12 Solution Providers
- The K-12CVAT offers a consistent and single questionnaire for solution providers to complete for potential and current K-12 organization clients to support evaluation and understanding of the risks and opportunities of your product. The advantage of the K-12CVAT is that, once completed, your assessment can be used by multiple K-12 organizations to streamline procurement processes with your K-12 clients
- The K-12CVAT is based off the Educause Higher Education Community Vendor Assessment Tool – Lite (HECVAT-Lite), however, the questions are geared specifically towards K-12 education. Please make sure to use the K-12 questionnaire for your K-12 clients.
“The K-12CVAT provides our district with a new view of our vendors and affords us the ability to make better informed decisions due to the easy-to-understand Summary Report generated when the vendor completes it. It highlights areas of strength and weakness and will allow us to perform a higher quality risk assessment prior to engaging with the vendor. This is because the vendor information provided on the K12-CVAT is not always covered in our normal RFP process and includes areas such as their approach to securing their data center, the application/system and access to our data by their employees; their overall security policy and procedures; and, their disaster recovery, business continuity and change management procedures. Ultimately, it provides me with greater confidence in the decision-making process – whether I’m recommending that we select or reject the vendor.”
Deborah Ketring, CETL
CIO, Rockwood School District (MO)
CoSN Cybersecurity Advisory
