How to Answer the Accessibility Questions in a HECVAT

By Andrew Szigety, DHS Trusted Tester (TT‑2606‑09221). Published September 14, 2026.

HECVAT 4.1.6 has a tab called IT Accessibility. It holds four contact fields, one link field, and 13 scored questions, ITAC‑06 through ITAC‑18. Four of the 13 are marked critical and carry double weight. Twelve score on a Yes; ITAC‑18, about overlays and accessibility modes, scores on a No. Checked September 14, 2026.

What the HECVAT Is, and Which Tab This Is About

The Higher Education Community Vendor Assessment Toolkit is a questionnaire that colleges and universities send to vendors instead of writing their own. It is published by EDUCAUSE, free to download, and the version on that page on September 14, 2026 is 4.1.6. One workbook covers cybersecurity, privacy, IT accessibility and compliance, and which tabs you complete depends on how you answer a short set of questions on the Start Here tab.

Accessibility is its own tab, named IT Accessibility, and it turns on a single Start Here answer. REQU‑02 asks: does your product or service have an interface? The guidance next to it counts administrator interfaces as well as end-user ones, so most software answers yes. If you answer no, the workbook auto-fills the accessibility rows and you skip the tab entirely.

A university asking for a HECVAT usually asks for a conformance report at the same time, because the tab points at one twice. That is not duplication. The questionnaire records what you claim; the report is the per-criterion evidence a reviewer reads when the claim matters.

Every Row in the IT Accessibility Tab

Read out of the HECVAT 4.1.6 workbook on September 14, 2026. The importance and weight columns are the workbook’s own defaults, taken from its Questions sheet, and an institution can change them before it scores you. The last column is the response the workbook marks as compliant, which is worth knowing precisely because it is not always Yes.

Read from the HECVAT 4.1.6 workbook on September 14, 2026, downloaded from the EDUCAUSE HECVAT page. EDUCAUSE updates the toolkit and publishes an issue tracker of what changed between versions, so check the version number on that page against the file you were sent. Harbor has no affiliation with EDUCAUSE, and the HECVAT is EDUCAUSE’s copyright.

The Four Critical Questions, and What Has to Be True

These four carry a default weight of 20 each against 10 for the rest, which is the workbook telling you where a reviewer’s attention goes. Each one has a fact behind it that either exists or does not.

• ITAC‑06, a current VPAT or ACR. The test is not whether you have ever had one. It is whether one exists for the version under consideration and has been created or updated in the past 12 months. The guidance tells you to answer no if the report covers an older version, and to answer no if you do not know. A Yes here wants a date and a link or an attachment.
• ITAC‑07, the contractual commitment. Will you agree, in the contract, to meet your stated standard or WCAG 2.1 AA. This is the question people answer optimistically and then have to walk back at redline stage. Answer it with whoever signs contracts in the room.
• ITAC‑08, substantial conformance to WCAG 2.1 AA. The workbook defines substantially conform as entirely meeting WCAG 2.1 AA or almost all user and administrator features conforming, with limitations and workarounds documented where they do not. It also says plainly that if you conform to a newer standard such as WCAG 2.2 AA, answer yes. So testing to 2.2 answers this one with margin, which is the same reason it answers a Title II requirement.
• ITAC‑09, reporting and tracking issues. Documented and implemented, both words. The guidance disqualifies the common answer directly: if the process is merely a feature-request tracker, the answer is no. A Yes wants the process described and a recent example of something that got fixed because of it.

The Rows Where Answers Usually Go Wrong

• Claiming conformance an overlay is doing. ITAC‑18 exists to catch this, its compliant response is No, and its guidance states that third-party overlays or add-ons are not sufficient for products to conform with accessibility standards. ITAC‑12’s own reasoning goes further and says the use of overlays or AI plugins to automatically conform should affect scores negatively. What an overlay does and does not change is covered in do overlays make a website compliant.
• Attaching a report for last year’s release. A report is evidence about a version. ITAC‑06 asks about the version under consideration and about the past 12 months, and a reviewer cross-references it against your roadmap answer in ITAC‑14.
• Answering ITAC‑12 with the name of a scanner. The question asks how you verify conformance. The workbook’s own reasoning for it notes that automated tools can only detect around a quarter of issues, so they have to be supplemented, and that at minimum some manual testing needs to be part of the verification process. A methodology answer beats a product name.
• Treating ITAC‑17 as obvious. Whether every function works with the keyboard alone is the one claim a non-specialist reviewer can check in ten minutes, and the guidance points them at published instructions for doing exactly that. Verify it before you answer, and say when and on what platform you verified it.
• Leaving the accessibility contact blank. ITAC‑01 to ITAC‑04 are not scored, which is why they get skipped. They are also the fields a reviewer uses when they have a follow-up question, and an unanswered follow-up stalls a review as effectively as a low score.

The Order That Keeps the Answers True

Four of these answers, and arguably six, are claims about testing. That makes the sequence matter more than the wording.

• Test the product against WCAG 2.2 AA by hand, including the admin side. REQU‑02 counts administrator interfaces, so an audit that covered only the customer-facing pages leaves part of the tab unevidenced. Testing to 2.2 answers ITAC‑08’s 2.1 AA question and leaves you ready for the next standard a buyer names.
• Write the conformance report from the results. The ACR is the document ITAC‑05 links to and ITAC‑06 asks you to attach. Partially Supports rows with specific remarks read as credible; a report of all Supports with empty remarks is the kind reviewers push back on.
• Then answer the 13 questions, using the report for the factual ones and your own process documents for ITAC‑09, ITAC‑12, ITAC‑14 and ITAC‑16. Use the Additional Information column. Most of the guidance asks for a description, a link or a date, and an unexplained Yes is weaker than a No with a plan attached.
• Attach the report and send both together. The questionnaire and the report answer different halves of the same question, and sending one without the other usually produces a follow-up email that costs a week.

What to Attach

The document ITAC‑05 and ITAC‑06 are asking for is an ACR, an Accessibility Conformance Report, written on the VPAT template published by ITI. The template is free and no rule requires a third party to fill it in. It comes in four editions, and the INT edition reports WCAG, Section 508 and EN 301 549 in one document, which matters if a state system, a federal buyer or a European campus asks next. You can read a complete one before you commit to anything: Harbor’s sample ACR is published in full.

How many institutions can already find your report without asking is a fair thing to know. Harbor checked 107 recognizable SaaS vendors and found 30 publishing a conformance report a buyer could read without a form, a login or a sales conversation. The healthcare IT and education group was the best of the six verticals at 7 of 12, and it was still under three in five. The full finding is at the ACR availability research page.

Who Answers the Testing Questions

ITAC‑11 asks whether a third-party expert has audited the current version, and ITAC‑15 asks whether your staff keep a current accessibility skill set. The workbook’s guidance for ITAC‑15 names its own examples of what current means: IAAP certifications and Section 508 Trusted Tester. Naming a credential a reviewer can look up is the difference between an assertion and a checkable fact.

Harbor audits are performed and signed by Andrew Szigety, a DHS-certified Trusted Tester for web content, certificate TT‑2606‑09221, and a member of the International Association of Accessibility Professionals. That answers ITAC‑11 with a name and a date, and gives ITAC‑15 something specific to cite. The audit covers every unique template against all 55 WCAG 2.2 A and AA criteria by hand, and produces the ACR in the INT edition plus fix guides your developers can work from, which is what ITAC‑10 and ITAC‑14 are asking about. Harbor does not publish a fee. The scope and the fee are fixed in writing after a 15-minute call, before you commit to anything.

Harbor provides technical audits and conformance documentation, not legal advice, and is not affiliated with or endorsed by EDUCAUSE. Which questions a particular institution weights, and how it scores them, is set by that institution.

• Get a VPAT/ACR
• Read the Sample ACR
• Accessibility Questions in an RFP
• The Title II Deadlines
• Book the 15-Minute Call