Minimum standards and qualification required
Relevant delivery experience - At least two comparable LMS implementations within the last five years.
At least one implementation for an organisation of similar scale, complexity or regulated workforce.
Two contactable client references.
Evidence of successful data migration, implementation, adoption and ongoing support.
Core product capability - Existing, live SaaS LMS—not a product dependent on speculative future development.
Capacity for at least 1,300 active colleagues, with headroom for growth.
Mobile-responsive operation across common browsers and devices.
Role-based learning, compliance matrices, expiry management, audit trails, reporting, content upload, blended learning and historical-record migration.
Critical requirements should be available at contract award or by go-live, with no unapproved bespoke dependency.
Information security - Compliance with UK GDPR and the Data Protection Act 2018.
Appropriate data-processing agreement and subprocessor transparency.
UK/EEA hosting, or a legally compliant international-transfer mechanism.
Encryption in transit and at rest, role-based access controls, MFA for privileged accounts, audit logging, vulnerability management and incident response.
Current Cyber Essentials Plus or equivalent; ISO/IEC 27001 certification is strongly preferable.
Evidence of regular independent penetration testing.
Business continuity and resilience - Documented business continuity and disaster recovery arrangements.
Defined recovery time and recovery point objectives.
Regular backup and restoration testing.
Contracted availability target—typically at least 99.9%, excluding agreed maintenance.
Prompt notification and management of security or service incidents.
English and Welsh capability, or a firm, costed and contractually committed bilingual delivery plan.
ntegration and data portability
Secure APIs or proven integration methods for HR/workforce systems, Microsoft 365 and single sign-on.
Support for recognised learning-content standards such as SCORM 1.2/2004 and, preferably, xAPI.
Full export of user, learning, compliance, evidence and audit data in commonly usable formats.
No unreasonable restrictions or charges preventing data extraction at contract end
|