Why an open source LMS for the public sector needs different planning
A public agency leader usually inherits training duties that no vendor can waive: mandatory courses for employees, contractors and sometimes citizens, plus records that must survive audits and accessibility obligations that apply to every page and module. The short answer is that Moodle usually fits broad workforce and citizen training because its long-term support windows match budget cycles, Open edX fits large public course catalogs and custom learning experiences, and Canvas LMS is worth considering where the agency already runs it. The function changes in the public sector because accessibility law, data location and support timing constrain the build before any feature list is discussed, so the platform choice should follow from those constraints rather than the reverse.
Accessibility is the first constraint. The ADA Title II rule requires state and local government web content and mobile apps, including those provided through contracts or licenses, to meet WCAG 2.1 Level A and AA, with compliance dates of 26 April 2027 for entities serving 50,000 or more people and 26 April 2028 for smaller entities and special districts. An LMS is a web application, so the agency must audit the core theme, every installed plugin and the course content its staff or contractors publish. Confirm with counsel who owns remediation of instructor-made content and write that ownership into the contract before the platform is chosen. Data location is the second constraint. Federal, criminal justice and defense rules can reach a training system if it holds controlled or sensitive information, so ask early whether learner records or course data fall under FedRAMP, FBI CJIS Security Policy or CUI requirements, and whether the hosting provider can meet them. The third constraint is support timing. Moodle 5.3 carries security fixes until 1 October 2029, while Open edX supports only its latest named release, so a plan that depends on a release train rather than a fixed support window needs a funded upgrade calendar.
Which public sector obligations shape the LMS build
This table compares the main public sector obligations against what each one means for LMS hosting, course content and training records. Read each row as a question to answer before choosing a platform, hosting model or content workflow. The main takeaway is that accessibility dates, data classification and the jurisdiction you sit under decide more of the build than the choice between Moodle and Open edX.
| Obligation | What it asks for | What it means for hosting, content and records |
|---|---|---|
| ADA Title II WCAG 2.1 AA (US state and local government) | Web content and mobile apps must meet WCAG 2.1 Level A and AA. Compliance dates are 26 April 2027 for entities serving 50,000 or more people and 26 April 2028 for smaller entities and special districts. | Content: audit course pages, themes and plugins, and confirm who remediates instructor-made and contracted content. Records: confirm completion reports and certificates are accessible. Hosting: keep accessibility fixes in version control so upgrades do not regress them. |
| Contracted and licensed content | Content delivered through contracts or licenses falls under the same WCAG 2.1 AA requirement as content the entity publishes itself. | Content: add accessibility terms to vendor and SCORM or video supplier contracts before purchase. Ask suppliers for conformance evidence and test imported packages on the LMS before launch. |
| CJIS Security Policy v6.1 (criminal justice information) | Applies to staff who access criminal justice information. Version 6.1 took effect 26 June 2026 and requires FIPS 140-3 validated modules or AES with 256-bit keys for CJI in transit and at rest outside physically secure locations, plus at least monthly vulnerability scanning. | Hosting: confirm the LMS does not hold CJI, or that encryption and scanning meet v6.1. Records: keep training content free of CJI examples. Ask the agency which security awareness training staff must complete and how it is recorded. |
| FedRAMP scope for cloud-hosted LMS | FedRAMP covers cloud products that create, collect, process, store or maintain federal information on behalf of an agency. Systems used only for one agency's operations and not offered as a shared service are out of scope. | Hosting: a shared vendor LMS holding federal learner data may need FedRAMP authorization, while an agency-run instance on its own cloud tenancy may not. Confirm scope with the agency's authorizing official before choosing a provider. |
| NIST SP 800-53 Rev. 5 baselines | Federal control catalog. The SP 800-53B baselines select 149 controls and enhancements at low, 287 at moderate and 370 at high. Release 5.2.0 of 27 August 2025 is current. | Use as a control reference, not a certification. Map LMS access control, audit logging, configuration management and backup to the chosen baseline. Records: audit logs of training access and changes should be retained and reviewable. |
| NIS2 for EU public administration | Covers central government entities regardless of size and lists public administration as a high-criticality sector. Member States may extend it to local administration. It does not apply to entities in national security, public security, defense or law enforction. | Hosting: confirm whether the entity is in scope under national transposition, and whether the LMS sits inside an in-scope network. Records: management body and staff cyber training completion should be provable. Entities in law enforcement or defense should confirm exclusions with counsel. |
| Long support windows and upgrade planning | Moodle 5.3 has security support until 1 October 2029. Open edX supports only its latest named release, and Verawood is current with Willow due December 2026. | Hosting: plan upgrades around budget cycles. Moodle LTS suits long procurement horizons, while Open edX requires regular upgrades to stay supported. Confirm patch cadence and test environments in the scope of work. |
Sovereign hosting options for government learner records
Hosting Moodle or Open edX in an agency's own data center, or in a government data center the agency already operates, keeps learner records under direct agency control. Physical access, network segmentation and key management follow the agency's existing security program, which often simplifies questions about who can reach the data. The cost is that the agency carries the hardware, the operating system patching, the database and the backup tasks that a managed provider would otherwise handle.
- Direct control: Learner records stay in facilities and networks the agency already governs, with no third-party hosting layer to assess.
- Operating burden: The agency or its contracted integrator runs the servers, databases, cache layers and disaster recovery, and must staff for upgrades on the Moodle or Open edX release cycle.
- Capacity planning: Peak loads such as enrollment drives or mandatory training deadlines must be sized in advance, because scaling means buying or provisioning capacity.
- Evidence ownership: The agency produces its own logs, access reviews and change records for assessors, which helps where a control must be shown inside the agency's boundary.
- Recurring cost: Hardware refresh, licensing for supporting software, and staff time recur for as long as the platform runs.
Before choosing this option, confirm with your security office whether the facility already holds the authorization needed for the data classes involved, and confirm which controls the agency's existing program covers.
A managed provider located in the same country, and in some cases under national law, can run the LMS while keeping learner records in-country. This option moves the operating tasks to a provider while the agency keeps jurisdictional comfort. It suits organizations that want managed upgrades and backups but must avoid foreign access to records. The contract, not the hosting label, sets most of the protection, so the terms need to be explicit.
- Jurisdiction: Storage, backups and support access are kept within a named country, and the contract states where each copy sits.
- Support model: The provider handles patching, backups and monitoring, while the agency keeps decisions on configuration, identity and data retention.
- Subcontractors: Confirm which hosting, backup and support subcontractors touch the data, and where they are located.
- Security assessment: The agency or a national authority may require its own assessment of the provider, separate from any foreign certification the provider holds.
- Exit terms: Data return formats, deletion certificates and migration support should be written into the contract before go-live.
Confirm each provider's authorization status and assessment history directly with the provider and with the relevant national body, and ask for the subprocessor list in writing.
FedRAMP covers cloud products and services that create, collect, process, store or maintain federal information on behalf of an agency. OMB memo M-24-15 sets this scope and rescinds the 2011 memo that created the program. Systems used only for a single agency's operations on cloud infrastructure, and not offered as a shared service, are out of scope. An LMS hosted in a cloud environment that serves one agency alone may therefore fall outside FedRAMP, while a multi-tenant learning service sold to many agencies would normally be in scope. The agency's own policy and its legal counsel decide how that boundary applies.
- Scope test: Decide whether the LMS is a shared service offered to other agencies or a single-agency system, because that answer largely determines whether FedRAMP applies.
- Authorization level: Where FedRAMP applies, confirm the authorization baseline and the specific services covered, since an authorized cloud provider may not cover every service the LMS uses.
- Data classes: Learner records that include personal data may still require controls from NIST SP 800-53 at a chosen baseline, even when FedRAMP is not triggered.
- Inherited controls: The provider's authorization package supplies some controls, and the agency or integrator must document the rest.
- Recurring review: Continuous monitoring, annual assessment and change notices from the provider are recurring obligations to track.
Confirm the provider's FedRAMP authorization status, baseline and covered services directly in the official FedRAMP marketplace and with the provider's contracting team, and do not rely on a verbal statement.
Which open source LMS fits which public agency
Public agencies choose an LMS by workforce size, catalog scale, identity setup and how closely upgrades can follow their budget cycles. The three options below differ most on those points, so the checks in each card should be settled before a platform is shortlisted.
Moodle for broad workforce training
Moodle is licensed under GPL-3.0 and is the most common fit for agencies that need one platform for mandatory staff training, citizen courses and compliance records. Core ships SAML and LDAP authentication, so directory integration is available without custom code. Moodle 5.3.0 is the next long-term support release, with security fixes until 1 October 2029. Check that your web server document root points to the /public directory, and confirm your PHP and database versions before any upgrade.
Open edX for large course catalogs
Open edX is licensed under AGPL-3.0 and suits agencies that publish large public course catalogs with many authors and learner accounts. Verawood is the current named release, and the project supports only the latest release, so the agency must plan a regular upgrade cycle. Third-party authentication covers SAML 2.0, Shibboleth and OAuth2 providers. Bare-metal installation is complex, so confirm whether the partner will run it through Tutor or a service provider.
Canvas LMS where it is already standard
Canvas LMS by Instructure is licensed under AGPL-3.0 and is the practical choice where a государство or agency already runs it and staff know the tools. Adoption of an existing standard reduces retraining and LTI integration work. Confirm which Canvas distribution and hosting model you can run inside your own environment, and whether the agency's identity provider and records export requirements are supported without custom development.
Upgrade paths that match budget cycles
Moodle 5.3 requires 64-bit PHP 8.3 or later and PostgreSQL 17, MySQL 8.4, MariaDB 11.4 or SQL Server 2019 or later, and sites must run Moodle 4.4 or later to upgrade. Agencies on older versions need a staged plan that fits appropriation years. Open edX upgrades follow named releases, so budget for recurring upgrade work rather than one-time migration. Ask any partner for a written upgrade calendar and the testing evidence for each release.
Identity integration at directory scale
Public agencies usually authenticate staff through a central directory and citizens through a separate identity service, and the LMS must handle both without duplicate accounts. Moodle core includes LDAP, LTI, OAuth 2 and Shibboleth authentication plugins. Open edX supports SAML 2.0 and Shibboleth alongside OAuth2 providers. Confirm which identity protocol each agency system uses, and test provisioning and deprovisioning for leavers before go-live.
Integration points that government LMS projects must plan for
A government LMS sits between identity systems, workforce records and public-facing content, and each connection has its own owner and failure mode. The cards below cover the four integration points that most often shape scope, schedule and evidence for a public sector deployment.
Identity federation across agencies
Moodle core ships authentication plugins for LDAP, LTI, OAuth 2, Shibboleth and web services, and Open edX supports SAML 2.0, Shibboleth, OAuth2 and LTI third-party authentication. Decide early which directory is the source of truth for staff and citizen accounts, and who owns the federation metadata, certificates and attribute release rules. Confirm how the agency IdP handles deprovisioning when a person leaves, because a stale account is an audit finding.
Workforce records feed from HR
Training assignments for government staff usually depend on position, grade, location and supervisor data held in an HR or personnel system. Agree with the HR owner which fields are sent, how often the feed runs, and what happens when a record is incomplete or a person changes role mid-course. Test the feed with real edge cases such as leave, transfers and contractors, and confirm who signs off on the mapping rules.
Accessible content hosting and media
Course video, documents and interactive content hosted by the LMS fall within the accessibility duties that apply to state and local government web content. Assign ownership for captions, transcripts and remediation of instructor-made material before content is uploaded, not after a complaint. Confirm how the hosting environment serves media, whether players support keyboard control, and how external video services are handled.
Audit logging and retention
Auditors will ask who accessed a course, who completed it, and who changed a grade or certificate. Decide which authentication, enrollment and completion events are written to logs, where those logs are stored, and how long they are kept under the agency's records schedule. Confirm that log forwarding to a central security tool works with the identity and LMS components you chose, and that log access is restricted to authorized staff.
Upgrade path for the identity and LMS stack
Identity connectors and LMS plugins must be retested every time the LMS moves to a new release line, so the integration plan needs its own upgrade calendar. Moodle 5.3 requires PHP 8.3 or later and sites must run Moodle 4.4 or later to upgrade, which can affect older authentication plugins. Ask the partner which connectors are tested per release, who owns regression testing, and how a failed connector is rolled back.
How a public agency LMS rollout moves from requirements to support
The sequence turns agency training obligations into a hosted, authorized, accessible and supported Moodle or Open edX platform, with each phase closing on a written output that the agency signs off before the next one starts. It is built so that the support plan is set against the agency's budget and upgrade calendar from the start.
Define requirements and the accessibility baseline
Your team and DeployOpen confirm who the learners are, which course types and content formats must run (including SCORM or LTI packages), expected concurrency, and which laws apply, including whether the ADA Title II WCAG 2.1 Level AA deadline for your entity size applies. Accessibility scope is written down here, covering the theme, plugins and instructor-made content. The output is a signed requirements register with a named owner for each requirement and an accessibility baseline you can audit against.
Decide hosting and authorization path
Hosting options are compared against the data your learner records contain: an agency-run environment, a cloud account the agency controls, or a managed provider. If the platform will hold federal, criminal justice or controlled unclassified information, your compliance lead confirms the applicable framework, such as NIST SP 800-53 baselines, FedRAMP scope or the CJIS Security Policy, before any build starts. The output is a written hosting and authorization decision with the data classification it rests on.
Integrate identity and training records
The platform is connected to the agency's identity provider and to HR or personnel systems that assign courses and roles. Authentication methods available in Moodle core or Open edX, such as SAML, LDAP, OAuth2, LTI or Shibboleth, are chosen against your existing directory. Completion data flows and retention rules are tested with sample accounts. The output is a tested integration with an access matrix showing which roles can see which records.
Migrate content and run the accessibility audit
Existing course content is inventoried, cleaned and moved, with SCORM packages and external tools checked to confirm they still launch. An accessibility audit runs against WCAG 2.1 Level AA on the theme, templates, plugins and migrated courses, and findings are logged with an owner for remediation. Instructor-made content gets a separate remediation plan because responsibility for it must be agreed in writing. The output is a migration report and an audit log with each open issue assigned.
Pilot with a defined user group
A bounded group of learners and administrators, chosen to represent the main roles and devices in use, completes real courses and reports results through a structured feedback form. Reporting, certificates, reminders and accessibility checks with assistive technology are tested in the same pass. Defects are triaged and fixed before the pilot closes. The output is a pilot acceptance record listing the test cases passed, the defects open at close and the owner who accepted them.
Cut over to production
The production environment is built from the same configuration tested in the pilot, data is migrated under a freeze window agreed with the agency, and DNS, identity and integration endpoints are switched over. Backups and restore tests are run before go-live, and a rollback path is documented. The output is a cutover runbook signed off by the agency, plus a verified backup and restore record.
Hand over to support and an upgrade plan
The agency receives the runbooks, configuration records, access reviews and training for its administrators. The upgrade plan is matched to the platform's release and support windows, and to the agency's budget cycle, so that planned upgrades are funded before they are needed. Support scope, response expectations and the owner of each recurring task are set out in writing. The output is a handover package and a dated support and upgrade calendar that the agency's budget owner has approved.
Evidence auditors and inspectors ask for from a government LMS
This table maps each evidence type that auditors, inspectors and oversight bodies typically request to the Moodle or Open edX component or procedure that produces it. Read it as a starting inventory: confirm with your assessor which artifacts they accept and in what format. DeployOpen prepares the systems, controls and evidence, but independent auditors and certification bodies issue the assessment.
| Evidence area | What produces it | What to confirm before the assessment |
|---|---|---|
| Accessibility conformance records | Accessibility audit of the theme, plugins and core pages, plus a remediation log for instructor-made content | Which WCAG 2.1 AA criteria the audit covered, and who owns remediation of course content |
| Training completion and acknowledgment records | Course completion logs, policy acknowledgment activities and timestamped completion reports exported from the LMS | Retention period, whether records are exportable, and how signatures or attestations are captured |
| Access control and role evidence | Role assignments, enrollment history and authentication logs tied to the identity provider (SAML, LDAP, OAuth 2 or LTI) | Whether role changes are logged with date and approver, and how leavers are removed |
| Vulnerability scanning and patch records | Scan reports for the web server, PHP runtime, database and LMS code, with dated remediation tickets | Scan frequency required by your authorization or control baseline, and who receives the results |
| Upgrade and support logs | Change records for each Moodle or Open edX upgrade, including test results and rollback plans, plus the vendor support status of the running release | Which release line is supported at audit time and the dates the vendor lists for security fixes |
| Hosting and authorization documentation | System security plan, data flow diagrams, hosting boundary description and, where required, the cloud provider's authorization status | Whether the hosting provider holds the authorization your assessor requires, and whether the LMS sits inside its boundary |
How much does a public sector open source LMS cost, and what drives it
Do Moodle, Canvas or Open edX cost anything to license?
Moodle, Canvas and Open edX have no license fee for the software itself, because Moodle is licensed under GPL-3.0, Canvas LMS under AGPL-3.0 and the Open edX platform under AGPL-3.0. The money goes to the work around the software: hosting, setup, identity integration, accessibility remediation, content migration and ongoing support. Those are paid services or internal staff time, and they make up most of the budget. Ask any bidder to show the license line separately from services so the comparison with a hosted subscription is clear.
Which costs are one-time and which recur each year?
One-time costs usually include discovery and requirements, initial installation, theming, identity and single sign-on integration, content migration, accessibility audit and remediation, and acceptance testing. Recurring costs include hosting and storage, database and backup operations, security patching, monitoring, plugin and theme maintenance, the major upgrade cycle, and help desk support for learners and administrators. Recurring spend is often the larger share over a multi-year term, so ask for the one-time and annual figures as separate lines in any quote.
What drives the cost of a public sector LMS up or down?
The main drivers are the number of learners and peak concurrency, the number of identity sources to connect, how many integrations with HR or case management systems are in scope, the volume of legacy SCORM or external content to move, and how much custom theming is required. Accessibility work scales with the size of the existing course catalog and the number of third-party plugins. Hosting cost depends on whether the agency runs in its own data center, a government cloud or a sovereign provider. Reusing existing identity and hosting services lowers cost; building new ones raises it.
What must the agency provide before a partner can start?
The agency needs named identity administrators who can confirm directory sources, group rules and single sign-on settings. It needs content owners who can approve course inventories, decide what to retire, and sign off on accessibility fixes. It also needs a procurement route that can contract a fixed scope with milestones, plus security staff who can approve hosting, access and data handling. Missing any of these roles usually adds delay and change requests rather than extra software cost, so confirm them in writing during scoping.
How long does a public sector LMS rollout take?
Duration depends on scope rather than on the software choice alone. A pilot with one agency, a single identity source and a small catalog takes far less time than a statewide or multi-agency deployment that needs federated identity, content migration from several legacy systems and an accessibility remediation program. Procurement cycles often take longer than technical work. Ask a partner for a written timeline tied to named milestones, and check it against your budget cycle and the ADA Title II compliance dates for state and local government web content and mobile apps, which are April 26, 2027 for entities serving 50,000 or more people and April 26, 2028 for smaller entities and special districts.
Can our own staff run an open source LMS after launch?
Some agencies can, especially those with an existing Linux, database and web operations team, but running an LMS well requires repeatable patching, backup and restore testing, monitoring and a tested upgrade path. Moodle 5.1 requires a specific PHP and database version set and a web server document root pointed at the /public directory, so administrators need that skill on hand. Decide early whether to build an internal team, keep a support retainer, or combine both, and price each option against the staff time it consumes.
How do major and long-term support upgrades affect the budget?
Each major release brings a planned upgrade project with testing of themes, plugins and integrations, so upgrades are a recurring cost rather than an occasional surprise. Moodle 5.3 is the current long-term support release, with bug fixes until October 4, 2027 and security fixes until October 1, 2029, and it requires sites to run Moodle 4.4 or later to upgrade. Open edX supports only its latest named release at a time, so it implies more frequent upgrades. Budget for upgrades on the support window your chosen platform gives, and ask partners how they price each cycle.
What should a quote for a public sector LMS include?
Ask for a written scope that lists each deliverable, the assumptions behind it, and the exclusions. The quote should separate one-time implementation services from annual hosting, support and upgrade services, and show each identity, integration and migration item with its own line. It should name the accessibility audit method and who owns remediation of instructor-made content, state the support hours and response expectations, and describe what happens when scope changes. DeployOpen works from a fixed written scope before work starts, so compare any proposal against that same level of detail.
What to ask an implementation partner before procurement
Start by asking for evidence of past government accessibility audits, not general accessibility claims. Ask the partner to show how they tested a Moodle, Canvas or Open edX theme and course template against WCAG 2.1 Level AA, which testing tools and manual checks they used, and how findings were logged and closed. Because the ADA Title II rule covers content provided through contracts or licenses, ask who signs off on conformance for the agency's own web content and who keeps that evidence current after go-live. Ask the same questions about hosting: will the platform run inside the agency's boundary, in an agency-controlled cloud account or on premises, and who holds administrative access to the servers, database and backups?
Ask how the partner handles criminal justice information or controlled unclassified information, even when the training content looks harmless. Learner records can reveal role, clearance or access level, so ask whether the partner has written procedures for classifying those records and for applying FIPS 140-3 validated encryption where the CJIS Security Policy or NIST SP 800-171 applies. For identity, ask which protocols they have integrated with the agency directory (SAML 2.0, OAuth 2, LDAP or Shibboleth) and how deprovisioning works when staff leave. Confirm with the agency's own security office which baseline and authorization applies before the partner quotes controls.
Ask for a written upgrade plan tied to the support windows. Moodle publishes bug-fix and security-fix dates per release, and Open edX supports only its latest named release, so ask how the partner will schedule upgrades, test plugins against each new version, and keep the agency inside a supported window across budget cycles. Ask for a plugin audit method and for a remediation process for instructor-made content that names who fixes what, and by when. Require all deliverables, acceptance criteria, support hours and exit terms in a fixed-scope written statement of work before work starts.
Questions public agencies ask about LMS hosting and compliance
Does ADA Title II accessibility apply to an LMS run by a contractor?
Yes, when the contractor provides the content or service on behalf of a state or local government entity, the rule reaches it too. The ADA Title II rule covers web content and mobile apps provided through contracts or licenses, and it requires WCAG 2.1 Level A and AA. The compliance date depends on the entity's population: the ADA Title II web rule sets April 26, 2027 for entities serving 50,000 or more people and April 26, 2028 for smaller entities and special districts. Contract language should assign who fixes theme changes, plugin output and instructor-made course content, and who produces the conformance evidence. Confirm the exact obligations with your agency counsel, since the contract, not the platform, usually decides ownership.
Does FedRAMP apply to a single-agency Moodle or Open edX deployment?
It usually does not, if the system serves one agency's own operations and is not offered as a shared service. FedRAMP's scope covers cloud products and services that create, collect, process, store or maintain federal information on behalf of an agency, and systems used only for a single agency's operations on cloud infrastructure, not offered as a shared service, are out of scope under M-24-15. The question changes if a vendor hosts the LMS for several agencies, or if the LMS is a shared service for a wider user base. Ask your agency's authorizing official and privacy office to confirm the boundary in writing, and document which data the LMS holds, such as training records that may include personal identifiers.
How does CJIS affect a training platform for law enforcement staff?
CJIS applies when the training platform stores, processes or transmits criminal justice information, such as course records linked to case access or systems with CJI in their data flows. The FBI CJIS Security Policy version 6.1 took effect on June 26, 2026, and it requires FIPS 140-3 certified modules or FIPS 197 AES with at least 256-bit keys for CJI in transit and at rest outside physically secure locations. It also requires vulnerability scanning at least monthly. Treat the LMS as in scope unless you can show it holds no CJI. Plan for encryption at the database and transport layers, access logging, personnel screening for administrators and a documented scanning cadence. Confirm the required controls with your CJIS Systems Agency.
How should an agency plan Moodle minor and major upgrades?
Plan minor releases as a routine maintenance window and major releases as a project with testing, plugin review and a rollback path. Moodle ships major releases in April and October and minor point releases every two months. Moodle 5.1 requires 64-bit PHP 8.2 or later, and sites must be on Moodle 4.2.3 or later to upgrade. From Moodle 5.1, the web server document root must point to the public directory, so check the web server configuration before cutover. Moodle 5.3 is the current long-term support release, with security fixes until October 1, 2029, which suits agencies that align upgrades with budget cycles. Keep a staging copy, test every third-party plugin and record each change for your audit trail.
When should an agency choose Open edX over Moodle?
Choose Open edX when the main need is a structured course catalog with authoring tools, cohorts and learner-facing course delivery, and Moodle when the main need is internal workforce training, broad plugin coverage and classic LMS administration. Open edX is licensed under AGPL-3.0 and built on Python and Django, and its maintainers recommend running it in production through a service provider or with Tutor. Only the latest named release is supported, and Verawood is the current release, with Willow planned for December 2026. That means upgrades are frequent and must be planned. Moodle offers a longer security support window, which many agencies prefer for stable internal training. Run a requirements check against your identity, reporting and accessibility needs before deciding.
What does an agency pay for when hosting its own LMS?
Moodle and Open edX have no license fee, so the costs are hosting, setup, integration, content migration, upgrades, accessibility work and support. Hosting is recurring, while setup, theming, identity integration and the first migration are usually one-time costs. Costs rise with concurrent users, the number of identity sources, the amount of third-party plugin work and the number of course records to migrate. Ask any implementation partner for a written scope that lists the environments, identity integrations, accessibility audit, upgrade calendar, backup and recovery tests and support hours. Compare that quote with the subscription cost of a hosted LMS over the same period, including data residency and exit terms.
Can DeployOpen run the LMS inside our own government cloud or data center?
DeployOpen plans, implements, integrates, hardens, backs up, upgrades and supports self-hosted open-source platforms inside the client's own infrastructure, including their cloud accounts, data centers or air-gapped networks. Engagements are usually fixed-scope, with scope, deliverables and timelines agreed in writing before work starts. DeployOpen prepares systems, controls and evidence for compliance assessments, but it does not issue audit reports, attestations or certifications, which independent auditors and certification bodies provide. Ask the partner to show how they handle accessibility testing, upgrade windows and evidence packages, and confirm which authorization or assessment steps your agency still owns.
How DeployOpen scopes, builds and supports a public sector LMS
DeployOpen plans, implements, customizes, integrates, hardens, documents and supports self-hosted open-source learning platforms inside the client's own infrastructure. For public sector training, that means the agency or ministry keeps learner records and hosting under its own control, with the work agreed in writing before it starts.
How we scope
- We confirm which platform fits the workforce, citizen audience and hosting boundary before any build begins.
- The written scope lists accessibility targets, identity sources, content types and the agencies or sites in use.
- Engagements are fixed-scope, with deliverables and timelines agreed in writing, and a quote follows from that scope.
How we build
- We configure the platform, theme and plugins against the agreed accessibility standard and test them with assistive technology.
- We integrate identity and directory sources, such as the agency's federated login, and document each connection.
- We harden the deployment in your cloud, data center or disconnected network and document the controls for assessors.
How we hand over
- We deliver architecture, configuration, runbooks and an upgrade plan covering the platform's supported release windows.
- We document accessibility test results and open items so procurement and compliance staff can review them.
- We train your administrators to operate, back up, and apply updates so the agency can manage the platform after handover.
How we support
- Ongoing support, upgrades and continuous security testing are available as retainers, scoped in writing.
- We plan major upgrades around the platform's long-term support dates and your budget and procurement calendar.
- We rerun accessibility and security checks after plugin or theme changes and report findings to your owners.
