Moodle for public sector training

The hosting choice decides who holds administrative access to the Moodle database, the file store, backups and logs, and that answer shapes the rest of the architecture. A public body usually considers three options: a national or sovereign data center, a government cloud tenancy in a provider region the agency controls, or a managed Moodle partner that runs the stack. In a sovereign data center, the operator's own staff typically hold root and database roles. In a government cloud tenancy, the provider's engineers operate the hypervisor and storage layers, while the agency controls accounts, keys and application administration. With a managed partner, the partner's engineers administer the application and often the database, so the contract must name the locations and the roles involved. Ask each candidate for a written list of who can log in to each layer, from which countries, and under what approval.

Under the GDPR, two patterns count as transfers that teams often miss. Storing personal data outside the EEA is a transfer, and so is remote access from a third country, even when the person only views records on a screen during a support session. EDPB Guidelines 05/2021 (version 2.0) state both points directly. This matters for a training platform because learner records, assessment results and certificate data are personal data, and support desks, offshore managed-service teams and vendor engineers using screen sharing all touch them. Article 44 requires every transfer, including onward transfers, to meet the conditions in Chapter V, and infringements of Articles 44 to 49 carry fines of up to EUR 20 million or 4% of worldwide annual turnover under Article 83(5)(c). Map every role that can view learner data, its physical location, and whether backups replicate to other regions.

An EU location does not by itself settle the exposure. Under 18 U.S.C. 2713, added on 23 March 2018, electronic communication and remote computing service providers must preserve or disclose data in their possession, custody or control, whether that data sits inside or outside the United States. A provider with a US parent or US-based operators may therefore receive such an order even for an EU region. EDPB Recommendations 01/2020 (version 2.0) state that where a cloud provider needs access to data in the clear and the destination's public authority powers go beyond what is necessary and proportionate, the EDPB cannot envision an effective technical supplementary measure. Encryption does not fix this if the provider can access the keys. The guidelines' Example 12 treats engaging an EU processor subject to third-country law as outside the transfer definition, while complying with a third-country request would fall inside it. Assess this exposure with counsel before signing.

FedRAMP matters when a US federal agency, or a contractor serving one, hosts the platform on cloud infrastructure. In plain terms, FedRAMP covers cloud products and services that create, collect, process, store or maintain federal information on behalf of an agency. Under the scope set by OMB memo M-24-15 of 25 July 2024, systems used only for a single agency's operations on cloud infrastructure, and not offered as a shared service, fall outside FedRAMP. That does not remove federal security requirements. Agency systems under FISMA are still assessed against NIST SP 800-53, where the low, moderate and high baselines select 149, 287 and 370 controls and enhancements respectively. The agency must confirm its own classification with its authorizing official, record the reasoning, and check whether the Moodle tenancy will serve other agencies, since that changes the answer.

Under the ADA Title II web and mobile rule, state and local government web content and mobile apps must meet WCAG 2.1 Level A and AA, and this includes content provided through contracts or licenses. The compliance date is 26 April 2027 for entities serving 50,000 or more people and 26 April 2028 for smaller entities and special districts. A Moodle site that delivers training to staff, contractors or the public falls within this rule, and so does training content a vendor supplies under a license. Before planning the work, the agency should confirm with counsel which entity category it belongs to, because that category sets the date the agency must meet and how the population threshold is counted.

The review covers more than the Moodle core code. It reaches the site's theme, the content uploaded to courses, and every third-party plugin that renders pages or activities. In practice that means the login page, course pages, navigation, activity modules, H5P and SCORM packages, and quiz interfaces, including each question type that learners answer. Each of these layers can introduce barriers even when core Moodle is compliant. The agency should build a test inventory that lists every theme, plugin, and content package in production, with an owner for each item, so that testing covers the full learner path rather than a sample of courses.

Theme choice needs particular attention in Moodle 5.3, released on 5 October 2026, because it removes the Classic theme from core. Sites that still rely on Classic will need to select a replacement theme and test it before go-live. Custom themes and theme overrides, including custom CSS and template changes, must be retested against WCAG 2.1 A and AA after the theme choice changes. The same applies to every later upgrade, since a change in core templates or a plugin update can alter focus order, color contrast, or form labels in a theme that previously passed. Treat the theme as a versioned component with its own regression test set.

Automated scanning finds some barriers quickly, but it cannot confirm that a quiz is usable by keyboard or that a screen reader announces a SCORM player's controls in a sensible order. Manual testing should include keyboard-only navigation, screen reader checks on representative courses, caption and transcript review for video, and timed quiz checks that allow extra time where the course design requires it. For H5P and SCORM packages supplied by third parties, the agency should request each supplier's accessibility documentation and decide whether non-conforming packages will be remediated, replaced or retired. Contracts for new content should require conformance to WCAG 2.1 AA and name who performs the testing.

Plan two budget lines: one-time remediation of the existing theme, plugins and legacy content, and a recurring testing cycle after each upgrade and each batch of new content. When requesting a quote, ask the partner to list the theme, plugins, and content types in scope, the test methods used, who performs remediation, and what evidence is delivered. Ask whether retesting after each Moodle upgrade is included. DeployOpen can prepare test records and remediation evidence for the agency, but conformance decisions and any formal assessment remain with the agency and its independent reviewers.

Public bodies usually divide Moodle work across three parties: their own staff, a managed hosting provider and an implementation partner. The split decides who holds the database, who applies patches, who answers when a course fails at 9 a.m. on an exam day, and who signs for accessibility outcomes. Before any work starts, the written scope should name each party's responsibilities against the components that matter for public sector training: the web server and PHP runtime, the database engine, the authentication source, the theme and custom plugins, the backup policy and the release calendar. A scope that says only "set up Moodle" leaves each of those gaps open, and gaps are where cost overruns start.

The one-time build covers installation, hardening, course and category structure, role and permission design, theme work, plugin selection and configuration, and training for administrators and course designers. Data migration is a separate line. Moving courses, question banks, user records and completion history from an older system requires field mapping, test imports and reconciliation, and its effort depends on how clean the source data is. Accessibility remediation is also separate. Public bodies serving 50,000 or more people must meet WCAG 2.1 Level A and AA for web content and mobile apps from 26 April 2027, and smaller entities and special districts from 26 April 2028 (28 CFR 35.200). Ask the partner to scope an accessibility review of the theme, core activities and any custom plugin, and to state which findings it will fix and which the organization's own content owners must fix.

Recurring costs are where public bodies most often underestimate the total. Hosting, whether in national or sovereign infrastructure or with a managed provider, is paid every period. Security patching of the operating system, PHP, the database and Moodle itself is also ongoing. Upgrades between releases are the largest recurring item. Moodle 5.1 requires PHP 8.2 or later and PostgreSQL 15, MySQL 8.4, MariaDB 10.11 or SQL Server 2017 or later, and sites must be on Moodle 4.2.3 or later to upgrade. Moodle 5.3 requires PHP 8.3 or later, PostgreSQL 17 and sites on Moodle 4.4 or later. Confirm with the partner which release the site will run, which support window applies (Moodle 5.1 security support ends 19 April 2027), and what each upgrade includes, such as test environments, custom plugin compatibility checks and rollback.

DeployOpen engagements most often start as fixed-scope agreements, with scope, deliverables and timelines agreed in writing before work begins. Ask any provider for the same: a deliverables list, acceptance criteria, named exclusions, the responsibilities of the client team and a change process for requests that fall outside scope. Ongoing support, upgrades and continuous testing are available as retainers, and the retainer should state response expectations, patch cadence and what happens during a major release. DeployOpen publishes no price list. A quote follows from the written scope, so the most useful preparation is a clear statement of the systems to connect, the number of courses and users, the migration sources and the accessibility obligations that apply to the organization.