HECVAT Category

Consulting Services

Consulting Services covers controls and questions related to that domain. It outlines expectations institutions typically require from vendors. The category helps assess risk posture and operational maturity. It provides structure for consistent evaluation during security reviews.

Assessment Questions

CONS-01

Will the consultant require access to the institution's network resources?

Network access by outside consultants raises real exposure, so this item asks whether the consultant will need to reach the institution's internal resources such as servers, databases, or applications. This is a critical security concern because granting external parties access to internal networks introduces potential security risks. External access creates new potential attack vectors and increases the institution's attack surface.

CONS-02

Has the consultant received training on (sensitive, HIPAA, PCI, etc.) data handling?

Reviewers want assurance that consultants who touch sensitive data have been formally trained to handle it in line with regulations such as HIPAA and PCI. Specifically, it mentions HIPAA (Health Insurance Portability and Accountability Act), which governs protected health information, and PCI DSS (Payment Card Industry Data Security Standard), which governs payment card data.

CONS-03

Is the data encrypted (at rest) while in the consultant's possession?

Encryption at rest is what's being checked here, specifically whether data held in a consultant's possession is encrypted while stored. Data at rest refers to information that is stored on physical devices (like laptops, servers, USB drives) or cloud storage rather than data that is actively moving through networks.

CONS-04

Can access be restricted based on source IP address?

Source-based access control is the focus: whether your services can limit connections to systems, applications, or data according to the originating IP address. IP address restriction is a security control that allows or denies access based on the network location of the user.

CONS-05

Will the consulting take place on-premises?

The delivery setting for the engagement is what this clarifies, namely whether consulting work happens on-site at the client's premises rather than remotely. This is important from a security perspective for several reasons:

CONS-06

Will the consultant require access to hardware in the institution's data centers?

Physical access risk is what's being assessed: whether consultants engaged by your organization will need hands-on access to equipment inside the institution's data centers.

CONS-07

Will the consultant require an account within the institution's domain (@*.edu)?

Domain access is the concern: the institution wants to know whether consultants on the engagement will need an account within its own domain, such as consultant@youruniversity.edu.

CONS-08

Will any data be transferred to the consultant's possession?

Data custody is the question: whether the consultant will receive, store, or process any of your organization's data during the engagement. In a security assessment, this is crucial because any data transfer to external parties introduces potential security risks. If consultants will have access to your data (especially sensitive or regulated data), this creates additional security considerations including how the data will be protected during transfer, how it will be stored by the consultant, who will have access to it, and how it will be returned or destroyed after the engagement.

CONS-09

Will the consultant need remote access to the institution's network or systems?

Remote access risk is the concern, specifically whether the consulting provider will need to reach into your institution's network or systems to do their work. Remote access means the ability to connect to your organization's systems from an external location (like the consultant's office).