I mentioned to our Office 365 admins about adding this app to our tenant and one part of the requirement for allowing 3rd party Teams integrations is to provide a HECVAT form from the app vendor.
We have provided similar information to Microsoft to get M365 certified, but to my knowledge we have not provided this information to universities. I have reached out to our Education Team and will follow up if there are any changes.
Good to know and I would be interested to know if Microsoft and Google provide these on a one by one basis, or if they have a standard version of it that everyone downloads off their website.
The Community Broker Index lists the completed assessments that have been posted there. Google is in there for a couple of services, but I don't see Microsoft.
There are two options, a full assessment or lite assessment, which are just Excel files that you (the vendor) fills out with answers about security practices and policies. It looks like this is a fairly recent thing.
I've sent this to our education team to see if they would sponsor such a project with our security team. We do publicly document and address questions asked in the document on this site. https://trust.arcgis.com/en/
I'm not sure if that's a silver bullet, but it may be a good start!
