HECVAT 4.0 → SOC 2 Type II Crosswalk

For procurement review at academic medical centers

"Baseshift maintains SOC 2 Type II certification and can provide a HECVAT crosswalk on request. The table below maps each HECVAT 4.0 domain to the applicable SOC 2 Trust Service Criteria and the corresponding evidence location in the audit report."
HECVAT 4.0 Domain SOC 2 Trust Service Criteria Evidence Location
Institutional IT Risk Management CC3.1–CC3.4 Section III: Risk Assessment
Security Policy CC1.1–CC1.5 Section III: Control Environment
Data Governance & Classification C1.1–C1.2, CC6.1 Section III: Confidentiality
Access Control CC6.1–CC6.8 Section III: Logical & Physical Access
Physical & Environmental Security CC6.4–CC6.5 Section III: Physical Access Controls
Operations Security CC7.1–CC7.5 Section III: System Operations
Vulnerability Management CC7.1, CC8.1 Section III: Change Management / Ops
Incident Management CC7.3–CC7.5 Section III: Incident Response
Business Continuity & Disaster Recovery A1.1–A1.3 Section III: Availability
Privacy P1.1–P8.1 Section III: Privacy
Third-Party / Supply Chain Risk CC9.1–CC9.2 Section III: Risk Mitigation
Configuration Management CC8.1 Section III: Change Management
Network Security CC6.6–CC6.7, CC7.2 Section III: Logical Access / Ops
Encryption & Key Management CC6.1, C1.1 Section III: Confidentiality / Access
Audit Logging & Monitoring CC4.1–CC4.2, CC7.2 Section III: Monitoring of Controls
AI / Automated Decision-Making CC3.2, PI1.1–PI1.5 Section III: Risk Assessment / Processing Integrity

SOC 2 Type II report available under NDA. A NIST SP 800-53 Rev. 5 control mapping is available at the NIST 800-53 Mapping page. For NIH-funded and academic medical center customers requiring a signed BAA + DUA before engagement, see the Genomic Data Use Agreement Addendum template. For a one-page summary of Baseshift's compliance posture for AMC procurement reviews, see the Academic Medical Centers One-Pager. Contact sales@baseshift.io to request the SOC 2 report or an executed agreement.