Purpose & Scope
This guide describes the recommended secure configuration for MapleLMS when used by a federal agency. It covers the settings the agency controls and the shared-responsibility boundary between the agency and MapleLMS.
Applies to the MapleLMS SaaS offering (LMS, Online Examination, Content Authoring) hosted on AWS.
Identity & Access
- Enable SSO (SAML/OIDC) against the agency's identity provider; disable local passwords for agency users.
- Require multi-factor authentication for all administrative and privileged roles.
- Apply least-privilege roles — separate learner, author, administrator and reporting roles; review quarterly.
- Set session timeout to the agency standard (recommended ≤ 15 minutes idle for admin sessions).
Data Protection
- All data encrypted in transit (TLS 1.2+) and at rest.
- Restrict learner-record exports to authorized reporting roles only.
- Configure data-retention periods to match the agency's records-management policy.
Integrations
Any optional third-party integration (e.g. CRM sync) is disabled by default for federal tenants and is outside the FedRAMP authorization boundary. Enable an integration only after confirming it does not move federal data outside the boundary.
Logging & Monitoring
- Enable audit logging for authentication, administrative changes and data exports.
- Forward logs to the agency SIEM where required.
- Review access reports on the agency's standard cadence.
Shared Responsibility
| Area | MapleLMS | Agency |
|---|---|---|
| Platform & infrastructure security | ✔ | |
| Application patching & availability | ✔ | |
| User & role administration | ✔ | |
| SSO / MFA configuration | ✔ | |
| Data classification & retention settings | ✔ |
Contact
Security questions: security@maplelms.com · 202-888-8039