Can a self-hosted LimeSurvey replace Qualtrics for a government survey program?
LimeSurvey can cover many government survey needs, but only inside a boundary the agency controls, and the agency then owns the control work. Qualtrics holds FedRAMP High authorization, so an agency that buys it can rely on the provider's authorized control implementation and reference that package in its own assessment. A self-hosted LimeSurvey instance carries no such inheritance. The agency selects controls from the NIST SP 800-53 baseline assigned to its system, implements them, and produces the evidence that its authorizing official and Inspector General will review under FISMA.
The decision turns on control ownership and operating capacity, and feature parity comes second. FedRAMP's scope covers cloud products that handle federal information on behalf of an agency, and it excludes a system used only for one agency's operations on cloud infrastructure that is not offered as a shared service. Confirm with your authorizing official which path applies to a LimeSurvey deployment. The baseline also sets the workload: SP 800-53B selects 287 controls and enhancements at the moderate baseline and 370 at the high baseline, so the assigned impact level determines how much documentation and testing the agency must own.
Operating capacity is the constraint most programs underestimate. The team must patch LimeSurvey, which is at version 7.6.0 as the latest stable release, because the 6.17.19 line reached end of support on August 31, 2026. It must also keep PHP, the database and the server stack within the supported versions, run backups and vulnerability scanning, and test restores. Accessibility is a separate obligation: under the ADA Title II rule, state and local government web content must meet WCAG 2.1 Level A and AA from April 26, 2027 for entities serving 50,000 or more people. Confirm the accessibility of your survey templates before launch. The sections that follow cover accessibility, respondent data retention and the operating work in more detail.
Which federal control requirements apply to a survey system?
A survey system inherits the control obligations that match the data it collects and the agency that owns it. No single rule covers every government survey program, so the first step is to map the data type, the system boundary and the authorizing official's position before choosing between a cloud product and a self-hosted platform.
NIST SP 800-53 control baselines
NIST SP 800-53 Rev. 5 is the federal control catalog, and SP 800-53B selects controls into low, moderate and high baselines containing 149, 287 and 370 controls and enhancements respectively. Your authorizing official decides which baseline fits the survey data. For a self-hosted LimeSurvey deployment, each selected control must be assigned an owner, either the agency, the hosting provider or the survey team, and documented in the system security plan.
FISMA and Inspector General review
NIST lists FISMA and OMB Circular A-130 among the laws behind SP 800-53. Under FISMA, Inspectors General independently assess agency system security and report to OMB, so a self-hosted survey system will be examined as an agency system. Confirm with your Inspector General's office which evidence they expect for a system you operate directly, including logs, configuration baselines and patch records.
FedRAMP scope under M-24-15
OMB memo M-24-15 sets FedRAMP scope as cloud products that handle federal information on behalf of an agency. A survey system used only for one agency's operations on cloud infrastructure and not offered as a shared service may fall outside that scope. Qualtrics holds FedRAMP High authorization, so the comparison turns on whether your LimeSurvey instance would be a shared service. Confirm this classification with your authorizing official before you commit.
CJIS encryption and scanning
If the survey collects criminal justice information, the FBI CJIS Security Policy applies. Version 6.1 took effect on 26 June 2026 and requires FIPS 140-3 certified modules or FIPS 197 AES with at least 256-bit keys for CJI in transit and at rest outside physically secure locations. It also requires vulnerability scanning at least monthly. Your LimeSurvey web server, database and backups must each meet these requirements, and you should confirm the exact cryptographic module list with your CJIS Systems Officer.
NIST SP 800-171 for CUI
Under 32 CFR 2002.14(h)(2), agencies use NIST SP 800-171 to set requirements for controlled unclassified information on non-federal information systems, unless the CUI category's own authority prescribes other safeguards. A survey hosted by a university, contractor or nonprofit that collects CUI would fall under these requirements. Identify the CUI category in your data inventory before deciding where responses and uploaded files will reside.
ADA Title II web accessibility dates
The ADA Title II rule requires state and local government web content and mobile apps, including those provided through contracts or licenses, to meet WCAG 2.1 Level A and AA. Entities serving 50,000 or more people must comply from 26 April 2027, and smaller entities and special districts from 26 April 2028. Survey pages you publish or host are covered, so test LimeSurvey themes and respondent flows against WCAG 2.1 AA before those dates, and record the results as evidence.
How Qualtrics and self-hosted options compare on government requirements
This table compares Qualtrics with LimeSurvey Community Edition, LimeSurvey Cloud's USA region and self-hosted Formbricks against the questions government survey teams usually raise: authorization status, where data sits and who operates the platform. Read each row as a question to answer for your own authorization boundary before any procurement decision. The main takeaway is that open-source self-hosting moves authorization evidence and day-to-day operating work onto the agency, while Qualtrics relies on the vendor's existing authorization.
| Option | How it meets the constraint | Trade-offs |
|---|---|---|
| Qualtrics | States FedRAMP High authorization; confirm the package and scope in the FedRAMP Marketplace. | Control ownership and hosting sit with the vendor under its authorization; review its controls and retention terms. |
| Self-hosted LimeSurvey Community Edition | GPL v2.0 or later and free to download; data stays on servers the agency runs inside its boundary. | No vendor authorization; the agency must document, assess, patch, back up and control access itself. |
| LimeSurvey Cloud, USA region | USA hosting region is offered; the vendor makes no FedRAMP claim on this page, so ask for authorization status. | Vendor-operated hosting; any authorization evidence must come from the vendor and be checked against agency requirements. |
| Self-hosted Formbricks Community Edition | AGPLv3 core with unlimited surveys, responses and users, but only one workspace in Community Edition. | Enterprise module code needs a license key; confirm the license terms before any multi-workspace government deployment. |
Where control ownership moves when the agency self-hosts
With Qualtrics, the provider's authorization package covers the platform, and the agency still owns the controls that sit around it. Qualtrics holds FedRAMP High authorization, which means the provider's documented controls inherit into the agency's system security plan for the parts it operates. The agency still implements its own controls for accounts, user provisioning, content it puts into surveys, and how it exports and retains responses. Under the FISMA framework, the agency's Inspector General still assesses how the agency runs its systems, regardless of who hosts the platform. Before choosing either path, pull the provider's current authorization documentation and map each inherited control to a line in your own plan, so you know exactly which controls remain yours.
Self-hosting LimeSurvey moves most of that inheritance back to the agency. The authorization package must cover the LimeSurvey application, the PHP and database hosts, backups, identity integration and logging. For the stack, LimeSurvey requires PHP 8.1.29 or later with the mbstring and PDO drivers, and a database of MySQL 8.0, PostgreSQL 14, MariaDB 10.3.38 or MSSQL 2019 or later. Each component needs a named operator, a documented implementation for each applicable control in the SP 800-53 baseline you select, and evidence that patches and scans run on schedule. Whether the agency or a contractor operates these components, the written responsibilities matrix should name who does each task and who reviews the output.
Version tracking is a control decision in its own right. The 6.17.19 line of LimeSurvey Community Edition reached end of support on August 31, 2026, while 7.6.0 is the latest stable release. Any instance still on 6.17.19 after that date runs without vendor security fixes, and your plan should record the upgrade path, its test environment and the approval step before production. Confirm the current support window and release notes directly on the LimeSurvey community downloads page before you set the upgrade schedule, because the support status may change after this page is published.
How to stand up LimeSurvey inside the boundary
This sequence takes an agency from an agreed authorization boundary to a LimeSurvey deployment that is hardened, monitored, backed up, documented and ready for accessibility review before any public or staff survey launches. Each step names who acts and what evidence closes it.
Confirm the boundary and baseline with the authorizing official
The agency's authorizing official, system owner and information security team decide what the survey system is, which data it will hold, and which control baseline applies. NIST SP 800-53B defines low, moderate and high baselines, and the agency should confirm whether any survey will carry criminal justice information, which brings in the FBI CJIS Security Policy. A contractor can help map controls, but the agency owns the boundary decision. The step is complete when the boundary diagram, data categories and baseline are signed off in the system security plan.
Select hosting, operating system and database versions
Choose the infrastructure that sits inside the boundary, whether that is agency-owned servers, a government cloud tenancy or a provider's dedicated environment, and confirm it meets the agency's own authorization requirements. Match LimeSurvey's documented requirements for PHP, its extensions, and a supported database such as MySQL, PostgreSQL, MariaDB or MSSQL. Check the LimeSurvey community downloads page for the current stable release and for end-of-support dates on older lines before fixing versions. The step closes with a bill of materials listing every component and its supported version.
Deploy the application in the agency environment
The agency's platform or operations team installs LimeSurvey from the official source into the approved environment, with the web tier, application and database separated by network controls the boundary diagram shows. Configure configuration files, file system permissions and the upload directory so that the application runs without unnecessary write access. A contractor typically performs the build and documents each setting. The step is complete when a smoke test passes in a non-production environment and the deployment record lists every version and configuration key used.
Configure encryption at rest and in transit
Enforce TLS for every connection that carries respondent data, including the browser to web server path and the application to database path. For CJIS-scoped data, the policy requires FIPS 140-3 validated cryptographic modules or AES with at least 256-bit keys for information at rest and in transit outside physically secure locations, up from 128-bit in the prior version. Confirm with the cryptographic module vendor and the assessor which modules are validated and how they are enabled. Encrypt the database volume, the upload directory and backups. The step closes with a configuration review that shows each encrypted path and its module.
Set up identity and administrator access
Decide how staff and administrators authenticate, whether through the agency's existing single sign-on, multi-factor authentication or directory groups, and document which roles can design surveys, export responses and manage users. Keep administrator accounts few, named and separate from ordinary survey editor accounts, and disable default accounts. Record who approved each role. The step is complete when a role matrix is approved by the system owner and a test account for each role confirms it can perform only its listed actions.
Schedule vulnerability scanning and patching
Configure authenticated and unauthenticated vulnerability scans of the application, operating system and database, with results routed to the agency's vulnerability tracking process. CJIS Security Policy v6.1 calls for scanning at least monthly, which many agencies set as a floor for all survey systems in scope. Set a patch process that tracks LimeSurvey releases and end-of-support notices, and assign owners for triage. The step closes when the first scan report is reviewed, findings are assigned, and the schedule is written into the operating procedures.
Back up and test restores
Configure scheduled backups of the database, the uploaded files and the configuration, and store copies encrypted and outside the primary system. Define the retention period with the records officer, because retention of survey responses is a records decision as well as a technical one. Run a documented restore into a separate environment, then compare record counts and a sample of uploaded files with the source. The step is complete when the restore test record shows what was recovered, how long it took, and what was missing.
Set up logging, retention and accessibility validation
Enable application, web server and database logs, forward them to the agency's central log platform, and set retention for logs, responses and uploads according to the records schedule. Decide who may export responses and how exports are logged. Before launch, test each public-facing survey against WCAG 2.1 Level A and AA with assistive technologies, since the ADA Title II rule applies to state and local government web content and to content delivered through contracts or licenses from 26 April 2027 or 26 April 2028 depending on entity size. The step closes with a signed accessibility test report and a log configuration record.
Document operating procedures and hand over
Write the operating procedures that cover change management, patching, scanning, backup and restore tests, access reviews, incident response for survey data, and decommissioning. Assign which tasks the agency keeps and which a contractor performs under a support agreement, and state the escalation path. Hand over the documentation to the operations team and test that they can run one full cycle without outside help. The step is complete when the procedures are approved, the responsibility split is signed, and the operations team has run a recorded test.
Which government survey programs need which controls?
Federal civilian agencies running research or customer surveys operate under FISMA, and NIST ties the federal control catalog in SP 800-53 to that law. The SP 800-53B baselines select 149 controls and enhancements at low, 287 at moderate and 370 at high. Qualtrics holds FedRAMP High authorization, so an agency using it can inherit many infrastructure controls from the provider. A self-hosted LimeSurvey instance moves those controls back to the agency or its contractor.
- Control ownership: Every inherited control becomes a documented responsibility in the system security plan, including hosting, backups, patching and access reviews.
- Authorization path: Ask the authorizing official whether the deployment sits inside the agency's own authorization boundary or falls under FedRAMP scope, because scope depends on whether the system is offered as a shared service.
- Baseline selection: Confirm the impact level for the survey data, since it sets the baseline and the number of controls to implement.
- Assessment evidence: Inspectors General independently assess agency system security and report to OMB, so logs, scan results and configuration evidence need to exist before that review.
Before choosing, confirm the impact level and the authorization path with the authorizing official and the agency's privacy and records officers.
State and local government entities must meet WCAG 2.1 Level A and AA for web content and mobile apps under the ADA Title II rule. The compliance date is 26 April 2027 for entities serving 50,000 or more people and 26 April 2028 for smaller entities and special districts. The rule also covers content provided through contracts or licenses, so moving a survey to a different platform does not move the accessibility duty away from the entity. Accessibility depends on the themes, question types and file upload paths the program actually uses.
- Date tier: The population served decides which date applies, so confirm the entity's category before planning the work.
- Contracted content: Surveys delivered through a vendor or a self-hosted tool remain the entity's responsibility under the rule.
- Testing scope: Test the live themes, question types, progress indicators, error messages and uploaded file prompts with assistive technology, not only the default template.
- Vendor evidence: Request conformance documentation from Qualtrics or from the LimeSurvey provider, and treat it as input to your own testing rather than as proof of compliance.
Ask counsel which surveys fall within the rule and whether the entity serves 50,000 or more people, because that answer sets the deadline. The rule text is available in the eCFR copy of 28 CFR Part 35, Subpart H.
Programs that collect criminal justice information (CJI) must meet the FBI CJIS Security Policy. Version 6.1 took effect on 26 June 2026 and comes with a Requirements Companion Document. It requires FIPS 140-3 certified modules, or FIPS 197 AES with at least 256-bit keys, for CJI in transit and at rest outside physically secure locations. It also requires vulnerability scanning at least monthly. Many government surveys never collect CJI, so the first task is to establish whether any survey does.
- Cryptography: Confirm the validated cryptographic modules in the TLS termination layer, the database encryption and the PHP runtime, since each component can change the answer.
- Scanning cadence: Monthly scans must cover the web server, the PHP runtime, LimeSurvey and every installed plugin.
- Version currency: LimeSurvey 6.17.19 reached end of support on August 31, 2026, and the current stable release is 7.6.0, so the patch plan must start from a supported line.
- Data scope: Uploaded files, exports and backups can hold CJI even when the questions do not, so include them in the boundary.
Confirm with the CJIS Systems Officer for your state how the policy applies to the survey system before any CJI is collected. The California DOJ bulletin on CJIS Security Policy version 6.1 summarizes the v6.1 changes, but your state agency sets the applicable obligations.
Federal agencies that set requirements for controlled unclassified information (CUI) on non-federal systems must use NIST SP 800-171 unless the CUI category prescribes other safeguards. Defense contractors pursuing CMMC Level 2 may store or process CUI in a cloud service only if that service is FedRAMP Authorized at the Moderate baseline or higher, or meets equivalent requirements. Non-cloud service providers are assessed within the contractor's own scope. Where the survey platform runs matters as much as which platform it is.
- Self-hosted scope: Running LimeSurvey on the contractor's own infrastructure keeps the platform inside the contractor's assessed boundary, which makes the contractor responsible for every control.
- Hosted option: Confirm the FedRAMP status and baseline of any hosted service before storing CUI there, because the supplied facts do not establish that LimeSurvey Cloud carries that authorization.
- Data location: Map where responses, uploaded files, exports and backups reside and who can reach them.
- Contract terms: Check whether the contract or the CUI category prescribes safeguards that differ from NIST SP 800-171.
Ask the contracting officer which safeguards the contract requires and ask the assessment body how the survey system fits into the contractor's scope. The CMMC program rule in 32 CFR Part 170 sets the cloud condition for CMMC Level 2.
Evidence the authorizing official and Inspector General will ask for
An authorizing official decides whether a survey system may operate, and an Inspector General reviews whether the agency's controls were actually applied. The six items below are the records that connect a self-hosted LimeSurvey deployment to the control set the agency selected. DeployOpen prepares systems, controls and evidence for assessments, while independent assessors and authorizing officials issue the decisions.
System security plan mapped to baseline
The system security plan describes the LimeSurvey stack, its boundary, data flows and who operates each component, then maps every implemented control to the baseline the agency chose. For a survey program, the boundary must include the web server, database, uploaded file storage, backups and any mail relay that sends invitations. Check that each control entry names an owner, an implementation method and the evidence location. Gaps should appear as documented risks, not as silent omissions.
OSCAL baseline profile as control set
Using the SP 800-53B baseline profile in OSCAL gives the team a machine-readable control list that can be loaded into governance tools and compared against the plan. It reduces manual transcription and makes version drift visible when the catalog changes. Confirm which baseline the agency's authorization requires, then confirm the profile release matches the catalog release the assessor will use. Record any tailoring decisions as explicit changes to the profile.
Vulnerability scan records
Scan reports from the LimeSurvey host, the database and the web tier show what was found, when it was found and how it was resolved or accepted. Assessors look for a consistent cadence, authenticated scans where they are feasible, and a ticket trail for each finding above the agency's threshold. Confirm with the agency which scanner and which scope it expects, and whether the PHP runtime and plugins are inside scan scope. Keep raw reports and the remediation log together.
Encryption configuration evidence
Evidence should show that data in transit uses current TLS settings on the public survey endpoint and the administrative interface, and that data at rest, including database volumes, backups and uploaded respondent files, is encrypted with keys the agency controls. Where a federal or criminal justice requirement applies, confirm whether FIPS 140-3 validated modules are required, since that determines the libraries and cipher configuration to record. Capture configuration exports and key management records, not only screenshots.
Accessibility test results against WCAG 2.1 AA
Survey pages are public web content, so accessibility testing should cover respondent-facing pages, the administration interface and any PDF or export outputs the agency publishes. Record test method, tester, date, pages covered and each defect with its status. Automated scans catch only part of the problem, so keep records of manual testing with assistive technology. Confirm the agency's target date, since the ADA Title II rule sets different compliance dates by population size.
Patching and version support records
Assessors will ask which LimeSurvey release is running, when it was installed and whether that line still receives security fixes. The community downloads page lists the current stable release and the end-of-support date for older lines, so the change log should show every upgrade against those dates. Record PHP, database and operating system versions alongside the application, and keep the patch approval trail for each change window.
What do agencies ask before self-hosting survey software?
What drives the cost of self-hosting LimeSurvey for a government program?
The software license is free, because LimeSurvey Community Edition is free to download and self-host. The cost sits in the components around it: the hosting environment inside your authorization boundary, the staff who install, configure and patch the application and its PHP and database stack, the assessment and documentation work that your authorizing official requires, and the recurring effort of monitoring and upgrades. Hosting and staffing recur every year. Assessment is largely one-time for the initial authorization, then recurs with each significant change. When you request a quote, ask each provider to split the price by these components, state who holds each responsibility, and name the assumptions behind the hours quoted.
How long does a self-hosted survey deployment take?
The timeline depends on three things: how many survey programs and user groups the deployment must serve, how much of the authorization boundary already exists, and which assessment path your agency follows. A single program on existing hosting is a different project from a multi-program platform that needs new infrastructure and a full assessment. No public duration is given here, so ask for a written scope with milestones, dependencies on your own change board and assessment staff, and the points where your agency must make decisions. A fixed-scope agreement should list each deliverable and the date it depends on.
What does the agency have to provide for a self-hosted survey platform?
The agency keeps the decisions that a cloud vendor would otherwise make for it. Expect to name a system owner, a data owner for each survey program, and an administrator who approves accounts and roles. Your security team must decide on encryption, logging, vulnerability scanning cadence and retention periods, and map each one to the controls in NIST SP 800-53 Rev. 5 that your baseline selects. Your assessors need access to evidence, and your authorizing official must accept the residual risk. Ask any implementation partner which of these tasks it performs, which it prepares evidence for, and which remain with your staff.
Can our internal team run LimeSurvey without an outside partner?
Many agencies can run it internally if they already operate PHP, database and Linux services inside an accredited boundary, and have people who can handle security patching and backups. The questions to answer honestly are whether you have staff for on-call support during survey fieldwork, whether you can meet the platform's supported version requirements on schedule, and whether you have assessment experience for this application. LimeSurvey Community Edition 7.6.0 is the latest stable release, and the 6.17.19 line reached end of support on August 31, 2026, so you need a plan to move between major lines. An outside partner can plan, implement, harden and document the platform, then support it under a retainer or hand it over.
What happens to collected responses if a LimeSurvey Cloud subscription expires?
When a LimeSurvey Cloud subscription expires, the account falls back to the Free package and keeps access to the collected responses, according to the LimeSurvey pricing page FAQ. That matters for records retention because it means expiry does not by itself delete your data. Before relying on this, confirm with the vendor the exact limits of the Free package, how long data is kept after expiry, and how exports are handled, and write those answers into your contract or retention schedule. Self-hosting removes this question entirely, since your agency controls the database, backups and deletion.
Does a hosted survey service meet FedRAMP requirements for federal data?
FedRAMP covers cloud products and services that create, collect, process, store or maintain federal information on behalf of an agency. Whether a given hosted service is authorized, and at what baseline, is a fact to verify in the FedRAMP marketplace or with the vendor, not something this page can assert. Self-hosting changes the question: a system used only for one agency's operations on cloud infrastructure, not offered as a shared service, is out of FedRAMP scope under the M-24-15 scope rules, but your agency still needs its own authorization under FISMA. Ask counsel and your authorizing official to confirm which path applies to your deployment.
Does the self-hosted survey platform meet accessibility requirements for public surveys?
State and local government web content, including content delivered through contracts or licenses, must meet WCAG 2.1 Level A and AA under the ADA Title II rule. The compliance date is 26 April 2027 for entities serving 50,000 or more people, and 26 April 2028 for smaller entities and special districts, according to 28 CFR 35.200. Accessibility depends on the templates, themes and question types you publish, not only the platform. Plan a test of your actual survey pages with assistive technology, record the results, and ask the implementation provider to include accessibility checks in the scope.
What should a written quote for this work include?
A useful quote lists the boundary and environment in scope, the number of survey programs and user groups, the hosting assumptions, and the assessment support included. It should separate one-time work (design, installation, hardening, initial documentation and evidence preparation) from recurring work (patching, upgrades, backups, monitoring and retainer support). Ask for the acceptance criteria for each deliverable, the assumptions about your staff and change board, and what is excluded, such as the authorization decision itself, which remains with your agency and its independent assessor. DeployOpen works from a written scope agreed before work starts and does not publish a price list.
How DeployOpen deploys LimeSurvey under a government boundary
DeployOpen plans, implements, hardens, documents and supports self-hosted open-source platforms inside the client's own cloud accounts, data centers or air-gapped networks. For a government survey program, that means building LimeSurvey inside the boundary the agency already controls and preparing the evidence its assessors will ask for.
How we scope
- Confirm which authorization boundary, baseline and assessor the LimeSurvey deployment must sit within before any build starts
- Agree in writing which survey projects, respondent data types and uploaded file categories the deployment will hold
- Record which controls the agency keeps, which DeployOpen configures and which the hosting provider inherits, as a shared responsibility matrix
- Fix deliverables, timelines and acceptance criteria in a fixed-scope statement of work signed before work begins
How we build
- Install LimeSurvey on the agency's approved infrastructure with the PHP, database and TLS versions its security team has accepted
- Configure respondent data retention, export controls, admin roles and logging so they match the agency's written records policy
- Test accessibility of survey templates and the admin interface against WCAG 2.1 Level AA with the agency's accessibility staff
- Run application and infrastructure security testing and track findings to closure before any live survey opens
How we hand over
- Deliver runbooks for installation, upgrades, backups, restores and rotating database and encryption keys
- Provide configuration baselines and evidence packages that the agency's assessors can review, without claiming any certification
- Train named agency staff on survey administration, export handling and incident response for the deployed system
- Document every component version and the upgrade path, including how the 7.x line will be patched over time
How we support
- Offer ongoing support, upgrades and continuous security testing as a retainer, priced from the agreed scope
- Schedule patching for new LimeSurvey releases and test them in a staging copy before production rollout
- Review backups and restore tests on a cadence the agency sets, and report results in writing
- Confirm with the agency's independent auditors which evidence they need, since DeployOpen does not issue audit reports
