HECVAT Tool usage

["John R. LaPrad" <jrl () SVSU EDU>]

We are talking about having cloud vendors fill out this assessment.  I 
am wondering how are institutions using this document.

 * Are vendors requested to fill it out during the RFP stage or after
   selection?
 *   Is it used to help make the purchase decision? If so, how is it
   quantified or scored so that responses can be compared across vendors?
 * What if vendors say that information is proprietary and don't answer
   many of the questions?

Thank you for the input.

John LaPrad - CISSP, CIHE
Information Systems Security Manager
Saginaw Valley State University
7400 Bay Rd. University Center, MI
Phone: 989-964-7134
jrl () svsu edu