An LMS passes a security review on evidence, not on a list of LMS security features. So send every vendor the same 18 written questions, and ask for a named document behind each answer.
A bare “yes, we have SOC 2” won’t do. It doesn’t tell IT which report, which audit period or which product it covers, and each missing detail costs another round of email while your purchase waits. Below are the 18 questions, what a complete answer contains, and the evidence to request for each.
Key Takeaways
- A usable SOC 2 answer names the type, audit period, auditor, product scope and result, and Litmos publishes all five.
- eloomi’s compliance page credits ISO 27001 and SOC 2 to Microsoft Azure, its host: a real certificate that isn’t the vendor’s.
- GDPR gives your vendor no hour limit for breach notice, only “without undue delay”, so the hours must go in the contract.
- NIST’s current guidance bans forced periodic password resets and composition rules, and requires at least 15 characters when a password is the only factor.
Piloting an AI LMS that builds courses from your own documents? Put it through the same 18 questions before anyone signs.
Why “Do You Have SOC 2?” Gets You a Useless Yes
SOC 2 is usually the first document a security review asks for, and a one-word answer to it tells your reviewer almost nothing. A complete answer has five parts:
- The type: Type I or Type II, stated rather than implied.
- The audit period: a start date and an end date.
- The auditor: the firm that signed the report.
- The scope: the product and systems the audit covered.
- The result: whether exceptions were noted, and what they were.
Litmos publishes them. Its SOC 2 Type II covers a “Full 12-month audit period 4/1/2024-3/31/2025”. The auditor is Aprio, the result is “no exceptions noted”, and its ISO 27001:2022 scope names the LMS it covers. Docebo publishes its observation period too: August 1 to July 31, with a new report every year.
Put all five parts into question 13, word for word. A vendor who sends them in one email has done this before. A vendor who needs a call to find the auditor’s name will likely need calls for the other 17 answers, too.
The 18-Question LMS Security Checklist
An LMS holds names, roles, managers and completion history for most of your staff. IT reviews it like any other system of record. Copy the four tables below into one document and send the same copy to every finalist, so each vendor answers the same questions, in the same order, against the same standard of evidence. If you’re still agreeing requirements with IT, the security lines in the LMS requirements checklist are the short version.
How to score the answers
Mark every answer Complete, Partial or Missing. Complete means the answer matches the middle column and the evidence is attached. Partial means the words are right but the document isn’t there. Missing means no answer at all, or a pointer like “see our security page” that gives IT nothing to file.
Then apply one rule. A Missing on question 2, 10, 11 or 15 ends the evaluation, because nobody can fix offboarding, subprocessors, deletion or breach notice after signing. Add question 13 if IT requires an audit report. Each Partial gets one follow-up email, and anything still Partial after it counts as Missing.
For example, a 600-person company sends the document to three finalists with a ten-working-day deadline. Two return 15 or more Complete answers. The third leaves question 11 Missing and drops out before a second demo, so IT reviews two sets of evidence, not three.
Identity and access
| # | Question to ask | What a complete answer contains | Evidence to request |
|---|---|---|---|
| 1 | Which single sign-on protocols do you support, and on which plan? | SAML 2.0, OpenID Connect or both. The identity providers already tested, and the plan that includes it. | The setup guide for your identity provider, and the plan named on the quote. |
| 2 | How is access removed when someone leaves, and how fast? | Automatic deprovisioning from your identity provider through SCIM, or a written manual process with a named owner. | SCIM documentation, and a trial test: deactivate one user from your identity provider. |
| 3 | Can multi-factor authentication be enforced for every admin? | Yes, enforced by policy, or through your identity provider when SSO is on. | The setting, shown in your trial account. |
| 4 | What password rules apply to accounts that don’t use SSO? | No scheduled resets and no composition rules. At least 15 characters when the password is the only factor, checked against known compromised passwords. | The written password policy. |
| 5 | What admin roles exist, and can an admin be limited to one group? | Named roles, custom roles, and admins scoped to a department, region or audience. | The permissions matrix. |
| 6 | What does the audit log record, and how long is it kept? | Sign-ins, role changes, deletions, exports and SSO changes. A retention period in years, like the five years eloomi publishes. | A sample audit-log export for one learner. |
Question 2 matters more than question 1. SSO controls who can sign in, but an account that outlives someone’s last day is one more thing IT has to close by hand. SCIM, the provisioning standard in IETF RFC 7643 and RFC 7644, lets your identity provider create, update and remove LMS accounts automatically. Its user schema even has an “active” flag your directory can switch off the day someone leaves.
On question 1, ask which protocol, not whether. SAML 2.0 is the OASIS standard for passing sign-in and permission details, approved in 2005. OpenID Connect is a sign-in protocol built on OAuth 2.0.
IT knows which one your identity provider runs. The vendor’s answer should name it, and the LMS SSO guide walks through the setup ticket that follows.
Question 4 catches old policies. Revision 4 of NIST SP 800-63B says services shall not force periodic password changes or require mixed character types. It requires at least 15 characters when a password is the only factor. A vendor that still forces scheduled resets is following the old checklist.
Data protection
| # | Question to ask | What a complete answer contains | Evidence to request |
|---|---|---|---|
| 7 | Where is learner data stored, and can we choose the region? | A named country or cloud region, and whether your plan lets you pick it. | The region written into the order form. |
| 8 | How is data encrypted in transit and at rest? | TLS 1.2 or higher in transit. AES-256 at rest. | The encryption section of the security documentation or audit report. |
| 9 | Who holds the encryption keys? | Who manages the keys and how often they rotate. Whether customer-managed keys exist, and on which plan. | A written answer, attached to the contract. |
| 10 | Who are your subprocessors, and how will you tell us about a new one? | A named list with each company’s purpose and location. A notice period before a new one starts, and your right to object. | The current list, and the data processing agreement clause. |
| 11 | What happens to our data when the contract ends? | Return in a named format, then deletion within a stated number of days, backups included. | The clause number, and a sample deletion certificate. |
| 12 | How often are backups taken, and how fast can you restore? | Backup frequency, how much data a failure could lose, how long a restore takes, and the date of the last restore test. | The disaster recovery test summary. |
Question 8 has a standard answer. NIST SP 800-52 Revision 2 requires federal systems to support TLS 1.2, and TLS 1.3 from the start of 2024. AES-256 is the 256-bit key version of the AES standard, NIST FIPS 197. “Industry-standard encryption” with neither named is a Partial.
Question 9 sounds like question 8, but it’s a separate test: encryption scrambles the data, and key custody decides who can unscramble it. Vendor-managed keys suit most training content. If legal has a rule about who may read personnel records, ask whether customer-managed keys exist.
Operations and compliance
| # | Question to ask | What a complete answer contains | Evidence to request |
|---|---|---|---|
| 13 | Which audit report or certificate covers this product? | SOC 2 Type II or ISO/IEC 27001, with the audit period, the auditor, a scope naming your product, and any exceptions. | The report, under NDA if required, or the certificate with its scope and expiry date. |
| 14 | When was your last independent penetration test? | The test dates, the testing firm, the scope (application, API, infrastructure), and whether critical findings were fixed. | A letter from the testing firm, or its executive summary. |
| 15 | How many hours after finding a breach will you notify us? | A number of hours in the contract. A notice that says what happened, whose data, the likely consequences and the fixes. | The data processing agreement clause. |
| 16 | What uptime do you commit to, and what triggers a credit? | A percentage, the measurement window (monthly or annual) and the credit trigger. | The service level agreement, and the status page history. |
On question 13, check the audit period’s end date against today. If the next report isn’t out, ask for a bridge letter, the vendor’s written statement covering the gap.
On question 16, the window changes the promise: measured over a year, 99.9% uptime allows about 8.8 hours of downtime, possibly all at once. Measured monthly, it allows about 43 minutes in a 30-day month. Docebo commits to 99.9% a month, but credits apply only after two months in a row below that line within any six-month period.
AI features
| # | Question to ask | What a complete answer contains | Evidence to request |
|---|---|---|---|
| 17 | Is our content or learner data used to train AI models? | No by default, in writing, covering the AI model provider as well as the vendor. | The data processing agreement clause, and the model provider on the subprocessor list. |
| 18 | What does a person review before AI content reaches learners? | AI output lands as a draft, an admin publishes it, and the record shows who approved it. | A trial walk-through of the approval step. |
Ask these two only if the platform writes content or answers learner questions with AI. An AI provider that handles your material or learner data for the vendor belongs on the question 10 list, with its location. Sorting which AI features are real helps you spot the ones worth asking about in the first place.
Three Ways a “Yes” Is Still the Wrong Answer
A vendor can truthfully say yes to “do you have ISO 27001?” and still send a document that doesn’t cover your purchase. What matters is whose certificate it is and what it covers. Check every yes against these three patterns.
The certificate belongs to the host
A cloud host’s certificate covers its data centers, not the LMS running inside them. eloomi says Deloitte audited it “with ISAE 3402/3000/ISO27001 on hosting, IT security and change management processes”, but its compliance page credits ISO 27001 and SOC 2 to Microsoft Azure. Skilljar runs its own SOC 2 Type II audit every year, but attributes ISO 27001 to AWS, its host.
The check: the company named on the certificate is the one you’re buying from.
The certificate belongs to the parent company
Gainsight, which owns Skilljar, publishes SOC 2 Type 2, ISO 27001:2022, HIPAA and GDPR at company level. Its trust site doesn’t break them out by product. Only the report’s scope statement tells you whether the academy product you’re buying was inside the audit.
The check: the scope section names your product.
The authorization runs through a partner, or the wording keeps changing
Tovuti states it “is FedRAMP Authorized through Knox Systems’ secure, approved FedRAMP cloud infrastructure.” A partner’s authorization and your vendor’s own produce different paperwork. Continu calls one audit “SOC 2 Compliant”, “SOC 2 Type II Certified” and “SOC 2 Type II Audited” on different pages. LearnUpon calls itself SOC 2 “compliant” with no type stated.
The check: grade the document, never the adjective. A yes that fails any of the three checks stays Partial until the right document arrives. The enterprise LMS comparison lists 13 platforms’ published attestations side by side.
What to Get in Writing Before You Sign
Three answers can’t be checked in a trial, only in the contract: subprocessors, breach notice and deletion. GDPR Articles 28 and 33 supply ready-made wording for all three. It works even if none of your learners are in the EU.
Subprocessors: notice and the right to object
Article 28(2) says “the processor shall not engage another processor without prior specific or general written authorisation of the controller.” Under general authorization, the vendor must tell you about new or replaced subprocessors, “giving the controller the opportunity to object.” Ask the clause to state the days of notice, how you’re told, and what happens if you object.
For each subprocessor outside the EU, ask which transfer mechanism covers it. Common answers are EU standard contractual clauses and the EU-US Data Privacy Framework, which the European Commission adopted in July 2023. A vendor still citing Privacy Shield is quoting a deal the EU’s Court of Justice struck down in 2020.
The breach notice: a number of hours
Article 33 gives your company, as the controller, 72 hours “where feasible” to notify the supervisory authority. It gives the vendor no number: “The processor shall notify the controller without undue delay after becoming aware of a personal data breach.” So the vendor’s deadline is whatever your contract says.
Ask for a number of hours. Ask, too, that the notice covers what your privacy team must file: what happened, which people and records, roughly how many, the likely consequences and the measures taken.
Deletion: a number of days and a certificate
Article 28(3)(g) requires the vendor, at your choice, to delete or return all personal data when the service ends, and to delete existing copies unless the law says to keep them. It sets no deadline. Skilljar’s data processing agreement shows a real one: return or deletion completes within 60 days.
Write the order into the clause: return first, in a named format, then deletion within a set number of days, backups included, confirmed by certificate. Article 28(3)(h) also makes the vendor provide the information needed to show compliance, and allow audits. That turns question 13’s report into something you’re owed, not a favor.
Paste all three clauses into your redlines before legal opens the vendor’s own paper.
Data Residency: What Vendors Publish About Where Data Sits
Question 7 splits vendors that look alike on everything else. Here’s what each one says.
| Vendor | What it publishes about where data sits |
|---|---|
| LearnUpon | A choice of EU, US or Australia. |
| Litmos | Customer-selectable hosting in the EU, Australia or the United States. |
| Intellum | US or Ireland. |
| Skilljar | Processing in the United States only. |
| 360Learning | Microsoft Azure “in locations non subject to the Patriot Act”, with no region named. |
| Docebo | No data center, region or residency option on its security page. |
| Eurekos | No data-center location, but an on-premise deployment on your own infrastructure. |
Two answers need a follow-up. 360Learning’s is a claim about jurisdiction, not a location, so ask for the region in the contract. Docebo names seven certifications and no country, a reminder that the two are separate questions.
If your policy fixes where learner data may sit, write the region into the order form. If it doesn’t, get the region named anyway, because you can’t judge question 10’s transfer mechanisms without knowing where the data starts. The cloud LMS comparison grades sixteen platforms on region and uptime.
If IT would rather host the platform itself, settle SaaS or self-hosted first. Self-hosting moves questions 7, 8, 12 and 16 onto your own team.
Where Mini Course Generator Stands on These Questions
Mini Course Generator is our product, and it should get the same document as every other vendor. Its published plan details answer part of it. SSO for learners, the REST API and an enterprise SLA sit on the Custom plan, so questions 1 and 16 depend on that plan. There’s no SCIM provisioning, so ask how a leaver’s access is removed before marking question 2 Complete.
Course content can be exported as PDF or SCORM packages at any time, whatever your subscription status. That covers the return half of question 11, not the deletion half. Send the rest of the list and grade what comes back, as you would for anyone else.
Send the 18 Questions Before the Next Demo
Copy the four tables into one document today, and send it to every finalist before anyone books a second demo. Give vendors ten working days. Score each answer, and drop any vendor with a Missing on questions 2, 10, 11 or 15. Keep your demo questions for the product, and file the security evidence with your LMS RFP responses so IT reviews one package.
While the answers come in, test the other half of the decision on your own material. Build a course from a policy document you already have on an AI LMS, and see what the platform does with it before anything is signed.
Frequently Asked Questions
What are the most important LMS security features?
Single sign-on with a named protocol, automatic deprovisioning, enforced multi-factor authentication for admins, an audit log kept for a stated period, and encryption in transit and at rest. Those are the easy half. The contract clauses on subprocessors, breach notice and deletion are what legal holds the vendor to after launch.
Do we need SCIM if we already have SSO?
If leavers must lose access without anyone remembering to remove them, yes. Watch for two near-misses.
“Automatic provisioning” can mean just-in-time provisioning, which creates or updates an account only when someone signs in, so a leaver who never signs in again keeps a live account until an admin removes it. And SSO and SCIM don’t always come on the same plan: Continu lists SAML single sign-on on its entry Growth tier but doesn’t say which tier carries SCIM. Ask for SCIM by name, on the plan you’re quoted.
Who should fill in the security questionnaire, L&D or IT?
The vendor fills it in, and IT grades it. Your job is to send one document early and chase the Partial answers, so IT isn’t starting from a blank page three weeks before the renewal date.
Is a SOC 2 report enough for a security review?
A SOC 2 Type II report covers the controls in its scope over its audit period. It doesn’t cover your contract, so subprocessor notice, breach timing and deletion still need their own clauses. If patient data could reach the LMS, a business associate agreement is a separate question, and the healthcare LMS comparison covers it.
Sources
- GDPR Article 28
- GDPR Article 33
- EU-US Data Privacy Framework, European Commission adequacy decision
- NIST SP 800-63B Revision 4
- NIST SP 800-52 Revision 2 and NIST FIPS 197
- IETF RFC 7644
- IETF RFC 7643
- OASIS SAML 2.0
- OpenID Connect
- Vendor trust, security and agreement pages: Litmos, Docebo, eloomi, Skilljar, Gainsight, LearnUpon, Continu, Tovuti, 360Learning, Intellum and Eurekos
- Mini Course Generator pricing page
