HECVAT and vendor security reviews

The HECVATHigher Education Community Vendor Assessment Toolkit. The security questionnaire many universities run on a new vendor. is how most universities assess a new vendor's security. Rather than ask you to send a blank questionnaire and wait, we keep a pre-filled HECVAT-Lite self-assessment that reflects the current state of First Six.

It records what is and isn't in place. Where a control isn't there yet, the response says so and gives the plan, rather than an optimistic "yes" that a pen test would later contradict.

The short version

First Six meets or exceeds the technical controls a standard HECVAT looks for. The open items are independent attestation and process maturity: the kind of thing that takes an external audit or time as a company, not an engineering change. We propose those as milestones for a pilot rather than blockers.

Headline answers

The full response set walks the standard HECVAT sections: company and documentation, data handling and privacy, authentication and access control, application and infrastructure security, and hosting and business continuity.

The vendor entity named in the company-and-documentation section is First Six Technologies Pty Ltd (ACN 699 938 817, ABN 19 699 938 817), registered in Queensland, Australia, trading as First Six.

What is still outstanding

Five items, and you would find all of them in a review anyway:

• SOC 2 / ISO 27001: not yet certified. The ISO 27001 documentation set (scope, statement of applicability across all 93 Annex A controls, objectives, audit programme) exists end to end; what is missing is operating records over time and the external attestation, and that distinction is exactly how we would put it to your auditor too.
• Third-party penetration test: planned, and we're happy to make it a contractual condition of a pilot. (Five vendor-run adversarial assessments ran between late June and the end of July 2026: 129 verified findings, four critical, all closed and re-verified against production on 2 August 2026, summarised in the security testing summary we share.)
• Business continuity: the early-stage-vendor question, and the honest answer is mitigations rather than a certificate: your data exports on demand, an escrow option, and a defined support contact. Ask us to put those in the agreement.
• Cyber insurance: to be obtained before production at scale.
• Prod / non-prod separation: done, and enforced rather than agreed. A separate non-production database was stood up in July 2026 and is kept in sync, so schema changes are verified there first. Since 11 August 2026 preview and development builds connect to it and not to production, and the rule is enforced in code: a deployment that is not production refuses to build if it is pointed at the production database. Each build says in its own log which database it accepted, so the separation is checkable after the fact rather than assumed. The residual we still name: both are separate projects inside one cloud organisation, so this is environment separation, not account separation. See how we change the platform safely.

Using it in your review

1. Ask for the responses

   Request the HECVAT-Lite self-assessment through your First Six contact or procurement. We share it under NDA, along with our security overview, subprocessor list, and incident-response summary.

2. Map it to your checklist

   The responses are organised by the standard HECVAT sections, so they line up with whatever internal checklist your team runs.

3. Read the gaps, not just the ticks

   Each item is marked Yes, Partial, Planned, or No, with a note explaining it. The notes are where the real picture is.

4. Set milestones for a pilot

   Where an item is still in progress, we can write it into the agreement as a milestone rather than treat it as a blocker.

Common questions

Related