Inside the Risk Playbook: How Three Universities Manage Institutional & Vendor Risk at Scale

Wednesday, May 21, 2025 | 9:00AM–9:45AM ET | Harborside Ballroom B, 4th Floor
Session Type: Breakout Session
Delivery Format: Industry Led
Managing risk at large, federated EDUs is no small feat—especially when balancing internal organizational assessments and vendor risk management across diverse campuses. This session brings together experts from three major institutions to share their approaches to streamlining risk assessments, increasing adoption, and scaling risk programs effectively. The University of Toronto (UofT) - will discuss their evolving approach to campus-wide information security risk assessments and how they’ve adapted their program over time to drive participation and efficiency. The University of Virginia (UVA) - will focus on vendor risk management, particularly their use of HECVAT assessments to evaluate third-party security risks and ensure vendor compliance. The University of Texas at Austin (UT) - will tie it all together, sharing strategies for integrating internal and vendor risk processes to create a more unified, scalable approach to security and compliance. They will also discuss transitioning from HECVAT v3.x to v4.0. Attendees will gain practical insights into structuring risk assessments, overcoming adoption challenges, and leveraging GRC technology to improve efficiency and visibility. A moderated panel discussion and Q&A will provide an opportunity for deeper engagement. Whether you're refining an existing program or building one from the ground up, this session will offer valuable takeaways to strengthen institutional information security risk management (ISRM) programs

Presenters

  • Cam Beasley

    Chief Information Security Officer, University of Texas at Austin

  • Drew Scheifele

    Co-Founder and CEO, SaltyCloud PBC

  • Brandy Smith

    IT Policy and Compliance Analyst, Senior, University of Virginia

Resources & Downloads

  • How Three Universities Manage Institutional Vendor Risk at Scale

    Updated on 5/21/2025