RFP LMS Managed Service for the NC Education Cloud No. 40

RFP LMS Managed Service for the NC Education Cloud No. 40
Response to:
RFP LMS Managed Service for the NC Education Cloud No.
40-IT00103-14
State of North Carolina Dept of
Public Instruction (NCDPI)
Submitted by:
Instructure, Inc.
11 September 2014
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
11 September 2014
State of North Carolina Dept of Public Instruction
Mr. Mike Beaver
[email protected]
Dear Mr. Beaver:
Instructure is pleased to respond to State of North Carolina Dept of Public Instruction’s RFP
LMS Managed Service for the NC Education Cloud No. 40-IT00103-14.
Canvas is designed to help NCDPI transform education by providing a single, integrated
learning management system (LMS) that bundles assessments, grading, standards tracking,
messaging, learning analytics, and more—while keeping everything simple, easy, and in one
place.
Over 400 K-12 institutions have chosen Canvas for their LMS because of the usability and
power of Canvas’s teaching and learning toolset and Instructure’s innovative corporate vision
and strong client support services. The Canvas platform has been adopted by K-12 education
organizations like Clark County School District (the 5th largest district in the USA), Rock Hill
School District, and Pasco County School District.
Instructure is confident that a successful Canvas deployment at the state level will produce
interest at the schools so we are offering 100,000 licenses complimentary to the state for
Professional Development purposes and 50,000 for use within the Virtual Public School.
Implementation fees would apply only.
If you have any questions or require additional information, please feel free to contact me.
Sincerely,
Melissa Gomez
K-12 Regional Director of the Mid-Atlantic Region
[email protected]
P:+1. 801.869.5010
C: +1.801.678.3021
FX: 888.213.3894
Instructure
6330 South 3000 East Suite 700
Salt Lake City ● Utah 84121
State of North Carolina Dept of Public Instruction
Volume I Technical Capability RFP LMS Managed Service for the NC Education
Cloud No. 40-IT00103-14
1
Letter of Transmittal
11 September 2014
State of North Carolina Dept of Public Instruction
Mr. Mike Beaver
[email protected]
Dear Mr. Beaver:
Instructure is pleased to respond to State of North Carolina Dept of Public Instruction’s RFP
LMS Managed Service for the NC Education Cloud No. 40-IT00103-14.
Instructure understands the work to be done, has the ability to meet the requirements of the
RFP, and is commited to performing the work within the specified parameters.
1.1
Submitting Organization
Table 1 Instructure Contact Information
Legal Business
Name
Address, Phone, and
Fax Number
6330 South 3000 East Suite 700
Salt Lake City, Utah 84121
Phone: 800.203.6755
Fax: 888.213.3894
Primary Contact and
Contact for
Clarifications
Melissa Gomez
K-12 Regional Sales Director
[email protected]
Phone: 801.678.3021
Contact with
Negotiation and
Contractual
Authorization
1.2
Instructure, Inc.
Jonathan Cook
Controller
[email protected]
801.869.5208
RFP Amendments
Instructure did receive an addendum to the Request for Bid #: #40-IT00103-14 and the signed
addendum is included on the following page.
6330 South 3000 East, Suite 700 Salt Lake City, Utah 84121 800.203.6755
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
We appreciate this opportunity to tell you about Canvas and our hosting and support services. If
you have any questions or require additional information, please feel free to contact me.
Sincerely,
Melissa Gomez
K-12 Regional Director of the Mid-Atlantic Region
[email protected]
P:+1. 801.869.5010
C: +1.801.678.3021
FX: 888.213.3894
Instructure
6330 South 3000 East Suite 700
Salt Lake City ● Utah 84121
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Table of Contents
1
2
Letter of Transmittal ........................................................................................................................... i
1.1
Submitting Organization .......................................................................................................... i
1.2
RFP Amendments ................................................................................................................... i
Proposal Summary ...........................................................................................................................6
2.1
3
What Makes Us Stand Apart: ..................................................................................................7
2.1.1
Easy to Use..............................................................................................................7
2.1.2
Adaptable .................................................................................................................7
2.1.3
Availability ................................................................................................................8
2.1.4
Canvas Overview .....................................................................................................8
Response to Technical Requirements/Sprecifications.....................................................................12
3.1
1.1.1
View Activity ...........................................................................................................39
1.1.2
View Communication..............................................................................................39
1.1.3
View Assignments ..................................................................................................40
1.1.4
View Grades ..........................................................................................................40
LMS Desirable Features .......................................................................................................98
4
References ................................................................................................................................... 101
5
Financial Information..................................................................................................................... 104
6
Cost Proposal ............................................................................................................................... 105
6.1
Canvas Subscription Fee Inclusions ................................................................................... 106
6.2
Canvas Implementation Service Package........................................................................... 106
6.3
Canvas Training Offerings .................................................................................................. 108
6.4
Canvas Support Packages ................................................................................................. 108
6.5
Canvas Tier I Support ......................................................................................................... 110
7
Conflict of Interest ......................................................................................................................... 116
8
Vendor’s Additional Terms and Conditions ................................................................................... 117
9
Errata and Exceptions................................................................................................................... 118
10 Copy of Vendor’s License and Maintenance Agreements............................................................ 119
11 Other Supporting Material Including Technical System Documentation ....................................... 120
12 Training and Other Materials, Samples or Examples ................................................................... 121
13 RFP Attachment 6 Responses .................................................................................................... 127
11 September 2014
Instructure, Inc.
i
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Instructure’s Terms and Conditions ............................................................................. 143
Appendix B.
Master Subscription Services Agreement .................................................................... 145
Appendix C.
Disaster Recovery ....................................................................................................... 146
Appendix D.
Canvas Security .......................................................................................................... 147
Appendix E.
Catalog – Registration and Payment Portal ................................................................. 148
E.1
Features and Functions ...................................................................................................... 148
Appendix F.
11 September 2014
Signed Forms .............................................................................................................. 153
Instructure, Inc.
ii
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Table of Tables
Table 1 Instructure Contact Information ...................................................................................................................... i
Table 2 Canvas K-12 Features .................................................................................................................................. 9
Table 3. Implementation Plan................................................................................................................................... 28
Table 4 Partial List of Third-Party Integrations Support ........................................................................................... 48
Table 5 Canvas Tools for Formative Assessment ................................................................................................... 52
Table 6 Canvas Tools for Summative Assessment ................................................................................................. 53
Table 7 Implementation Risks and Mitigation .......................................................................................................... 84
Table 8 Premium Support Package ......................................................................................................................... 86
Table 9 Instructure Tier I Support Costs .................................................................................................................. 87
Table 10 Instructure Tier I Support Service Levels .................................................................................................. 88
Table 11 Support Metrics ......................................................................................................................................... 89
Table 12. Reference: Knox County Schools .......................................................................................................... 101
Table 13. Reference: Rock Hill School District 3 ................................................................................................... 101
Table 14. Reference: Rockingham County Schools ............................................................................................. 102
Table 15. Reference: Utah Educational Network ................................................................................................... 102
Table 16. Reference: Katy ISD – Virtual School .................................................................................................... 103
Table 17. Canvas Subscription Inclusions Breakout .............................................................................................. 106
Table 18. Canvas Implementation Services Packages .......................................................................................... 106
Table 19. Canvas Implementation Services Package: Services, Duration, and Price........................................... 107
Table 20. Canvas Support Packages ..................................................................................................................... 110
Table 21. Canvas Tier I Support Service Levels .................................................................................................... 111
Table 22. Canvas Premium Implementation Service Package .............................................................................. 111
Table 23. Canvas Premium Implementation Service Package: Service, and Duration ......................................... 112
Table 24. Current LEAs or Charter School Customers .......................................................................................... 115
Table 25. Canvas Training Offerings Menu ........................................................................................................... 121
11 September 2014
Instructure, Inc.
iii
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Table of Figures
Figure 1 K-12 Adoption Rates .................................................................................................................................... 7
Figure 2. Permissions interface of the Administrator’s Settings tool. ....................................................................... 16
Figure 3. Enabling, Disabling, Locking Permissions ................................................................................................ 17
Figure 4. Example of a Canvas Product Release Note ........................................................................................... 19
Figure 5. Canvas Architecture .................................................................................................................................. 22
Figure 6. Canvas by Instructure for iOS. .................................................................................................................. 31
Figure 7. Canvas by Instructure for Android. ........................................................................................................... 31
Figure 8 SpeedGrader for iPad ................................................................................................................................ 32
Figure 9. Import Content processed jobs. ................................................................................................................ 35
Figure 10. Canvas Analytics: Course View .............................................................................................................. 38
Figure 11. Analytics Course View: Student Section ................................................................................................. 38
Figure 12. Student Summary Information ................................................................................................................ 39
Figure 13. View Activity ............................................................................................................................................ 39
Figure 14. View Communication .............................................................................................................................. 39
Figure 15. View Assignments ................................................................................................................................... 40
Figure 16. View Grades ............................................................................................................................................ 40
Figure 17. Faculty View: Gradebook ........................................................................................................................ 42
Figure 18. Curve Grades Feature in the Gradebook ............................................................................................... 43
Figure 19. Course Modules ...................................................................................................................................... 43
Figure 20. Canvas Collaborations interface. ............................................................................................................ 47
Figure 21. Peer Review Notification ......................................................................................................................... 48
Figure 22 Annotating, highlighting, and commenting on submissions. .................................................................... 52
Figure 23 Quizzes tool interface. ............................................................................................................................. 55
Figure 24 Quizzes tool: interactive scoring and feedback. ...................................................................................... 55
Figure 25 Moderate Quiz interface. .......................................................................................................................... 56
Figure 26 Selective release of course coursework/content. .................................................................................... 57
Figure 27. Create a Question Group ........................................................................................................................ 57
Figure 28 Canvas Quizzes: Quiz Statistics Redundancy and Failover .................................................................... 59
Figure 29 Canvas Conversations interface. ............................................................................................................. 60
Figure 32 Canvas Discussions ................................................................................................................................. 61
Figure 33 Canvas Discussions interface. ................................................................................................................. 62
Figure 34 Discussion Creation Tool ......................................................................................................................... 63
Figure 35 Discussion Settings .................................................................................................................................. 64
Figure 36 Masquerading as a user. ......................................................................................................................... 65
11 September 2014
Instructure, Inc.
iv
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Figure 37 Students Can Opt Into Receiving Grades Notifications in their Account Settings ................................... 66
Figure 38 ePortfolio tool. .......................................................................................................................................... 68
Figure 39 Canvas ePortfolio Example #1 ................................................................................................................. 69
Figure 40 Canvas ePortfolio Example #2 ................................................................................................................. 69
Figure 41. Rich Content Editor Interface .................................................................................................................. 70
Figure 42 Teacher View of Gradebook .................................................................................................................... 71
Figure 43 Weighting the Final Grade ....................................................................................................................... 72
Figure 44 Alerts Interface ......................................................................................................................................... 73
Figure 45 Annotating, highlighting, and commenting on submissions. .................................................................... 75
Figure 46 Student Gradebook View ......................................................................................................................... 76
Figure 47 Learning Mastery Gradebook Interface ................................................................................................... 78
Figure 48 Outcome Breakdown Percentages .......................................................................................................... 78
Figure 49 Filtering the Learning Mastery Gradebook .............................................................................................. 79
Figure 50 Viewing Outcome Statistics by Course Average, Median, or Mode ........................................................ 79
Figure 51 Mastery Gradebook: Individual View ....................................................................................................... 80
Figure 52 User role permissions interface of Canvas Administrator’s dashboard. .................................................. 82
Figure 53 Canvas Modules. ..................................................................................................................................... 93
Figure 54 Selective release of course modules ....................................................................................................... 94
Figure 55 Specifying Module prerequisite and completion criteria. ......................................................................... 95
Figure 56 Module progress by student. .................................................................................................................... 96
Figure 57 User reports in the course People tool..................................................................................................... 96
Figure 58 Rich Content Editor Interface ................................................................................................................... 97
Figure 59. Canvas Conferences Interface ............................................................................................................... 99
Figure 60. Canvas Chat Interface .......................................................................................................................... 100
Figure 61. Canvas Help Center. ............................................................................................................................. 120
Figure 62. Catalog’s Custom Branded Site ............................................................................................................ 148
11 September 2014
Instructure, Inc.
v
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
2
Proposal Summary
A proposal summary may be included by Vendors to provide the Evaluation Committee with an
overview of the technical and business features of the proposal; however, this material will not be
used in the evaluation process unless specifically referenced from other portions of the Vendor’s
proposal
The NCPDI has a reputation for excellence and innovation in education. The creation of the North
Carolina Virtual Public School (NCVPS) set North Carolina apart for seeing the value in incorporating
technology into education. Moving forward with a student population of close to 1.3 million, NCPDI
needs to ensure that they have a strong partner in order to create a virtual learning environment that
is intuitive enough to ensure high adoption rates, that is adaptive enough to meet the changing needs
of the students of North Carolina, and that is reliable enough to ensure that availability is virtually
unlimited.
Canvas provides a robust learning management system that offers the foundation to create rich
engaging asynchronous and synchronous learning opportunities to meet the needs of student-only
online mastery courses, instructor-led online courses and instructor-led courses in classroom
environments. Canvas offers the critical integration with the statewide Student Information system
(SIS)-Pearson PowerSchool, the statewide Learning Object Repository (NCLOR), and the statewide
Identity and Access Management Service (IAMS) for K-12 educators. Canvas offers an unparalleled
24/7/365 service option to ensure that we are helping you meet your student’s needs. Most
importantly, we define availability with our 99.9% uptime.
Canvas will provide the support you need to ensure that the Standard Course of Study is integrated
into the curriculum. Canvas Learning Outcomes allow you to effortlessly integrate learning outcomes
into every part of the course from the assignments to the assessments to the portfolio. When creating
an assignment or assessment, you can insert Learning Outcomes into the rubric so that when
instructors are grading an assignment, they are also providing data about student mastery. Learning
Outcomes can simplify tracking within schools and across the entire state.
We would love to have the opportunity to show you what Canvas has to offer as you move forward
toward your vision of “every public school student will graduate from high school, globally competitive
for work and postsecondary education and prepared for life in the 21st Century.” Our technology,
hosting, and tools will provide a solid foundation to support you as you continue to innovate and
revolutionize online education. We would be honored to be your partner in improving the lives of the
students of North Carolina and preparing them for success.
11 September 2014
Instructure, Inc.
6
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
2.1
2.1.1
What Makes Us Stand Apart:
Easy to Use
Areas in which Canvas stands out from other LMS systems include a native IOS course app that is
designed to make access to Canvas on mobile devices as simple as possible. Students want their
course information in the format that they actually use and that is most readily available to them. That
is why Canvas offers a Native iOS course app and a Native Android course app. Canvas also offers a
native mobile polling app. Ensuring that Canvas is easily available helps ensure that it gets used and
utilized. The intuitive nature of Canvas has led to extremely high faculty adoption rates, as shown in
Figure 1.
Figure 1 K-12 Adoption Rates
Canvas is designed thoughtfully and deliberately to be exceptionally easy to use with an elegant and
intuitive interface. Our goal is to have students access information in the fewest clicks possible.
Students, especially young students, can get frustrated when they cannot find the information they
need. Canvas’s dashboard shows students the most important information right when they log in. The
Dashboard answers the questions, "What is going on in all of my courses?" and "What do I need to do
next?" The dashboard provides a single view that allows students to view assignments, course
materials, and grades, as well as upload materials and submit assignments. This single view ensures
that students can quickly and easily find the information they need so that they can focus on learning.
2.1.2
Adaptable
Canvas strives to be adaptable to meet the needs of schools and universities around the world. Each
institution has unique needs. We want YOU to be able to find the solution that fits your exact needs.
11 September 2014
Instructure, Inc.
7
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Part of making that happen is having an open API to ensure that applications can be easily integrated
into Canvas. Something that sets us apart in the LMS industry is our one-click LTI installation. The
Canvas Edu App Center (https://www.eduappcenter.com/) is a rapidly-growing app library with over
130 apps providing interactive resources, content repositories, assessment tools, social media, and
other digital learning and teaching resources.
Canvas also lends itself to customization. Canvas does not expect you to modify your course content
to conform to a rigid course template or to fit into a pre-determined course organization. Merely
inserting course content into premade molds does not create the best educational opportunities.
Canvas provides you the tools and freedom to innovate and create courses that fit your students’
unique needs as well as your pedagogical goals.
Instructure believes that Canvas should empower teaching and learning without burdening teachers
and students. Technology is a tool of education, and if we do our work right Canvas, first, stays out of
the way, and, second, encourages teachers and learners to innovate and improve their practice. We
want to ensure that we are constantly evolving to meet the needs of our clients. For this reason, every
client has the opportunity to discuss improvements and changes with an assigned Customer Success
Manager.
2.1.3
Availability
Availability and access are another critical aspect of a virtual learning environment. If you create an
engaging, intuitive learning environment, but the system is frequently down, you will have students
who are unable to access the rich experience that you have created. Canvas knows that availability is
critical; that is why we guarantee an unparalleled 99.9% uptime. When we install updates, we do our
best to ensure that your system remains up. We also install updates on days that are typically less
busy, like a late Saturday afternoon.
Canvas is the only LMS hosted on a native cloud. This means that you will never have to do another
update or worry about versions. All updates are hands-free, meaning you don’t have to do a thing.
Canvas also offers automated provisioning to ensure that system availability is always high. If we get
a spike, we take advantage of the native cloud to make sure that everything is evenly distributed so
that your students don’t experience slower service. Finally, Canvas has an open API. We want to
make it easy for you to integrate with other software, programs, and services that will optimize your
system.
2.1.4
Canvas Overview
Canvas K-12 is a single, integrated learning management platform that bundles assessments,
grading, state standards tracking, messaging, learning analytics, and more, while keeping everything
simple and in one place.
Canvas K-12 can be accessed from anywhere at any time, helping teachers engage students, and
allowing parents to co-enroll in classes to track assignments and grades. Because Canvas K-12
requires no programming knowledge, teachers can easily create, manage, and reuse course content.
11 September 2014
Instructure, Inc.
8
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Usually teachers, administrators, students, and parents already have the skills needed to navigate,
learn, and use Canvas K-12.
Canvas K-12 is hosted by Instructure on the Amazon Elastic Compute Cloud (EC2) and uses the fully
redundant storage resources of the Amazon Simple Storage Service (S3). Canvas K-12 can be
accessed from any computing or communications device with Internet connectivity and a compatible
web browser, including tablets and smart phones. Canvas guarantees 99.9% system availability and
provides full support, rolling updates with no downtime, backups, and data recovery.
Table 2 includes a sampling of Canvas K-12 features.
Table 2 Canvas K-12 Features
Canvas K-12 Features
Accessibility
Canvas K-12 complies with accessibility standards and is
suitable for teachers and students of all abilities.
Flexible Pedagogy
A variety of teaching styles, frameworks, and Web technologies
are supported.
Parent Co-enrollment
Parents can be co-enrolled with students to monitor
assignments, grades, missing work, and teacher
communication.
Learning Analytics
Teachers, administrators, and parents can monitor student
engagement, track activities, and use predictive profiles to help
at-risk students.
Standards Reporting
Objectives for state standards can be aligned with course
assessments for easy standards reporting.
Integrated Calendar
Calendar events are scheduled and rescheduled with drag-anddrop functionality, plus automatic event notifications.
Rich Content Editor
Video, audio, images, tables, math formulas, and URL links can
be embedded easily into course content.
Assignments
Submission formats include web pages, Word docs, video,
audio, slide shows, and more.
Online Testing
Quizzes can be created from scratch or from question banks
with a variety of question types and quiz options.
11 September 2014
Instructure, Inc.
9
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Canvas K-12 Features
Rubrics
Created from sets of teacher-defined criteria, rubrics provide a
structured, consistent, and prescriptive framework for
assessment.
Learning Mastery
Gradebook
Helps faculty and administrators tracks standards and assess
the outcomes that are being used in Canvas courses
Learning Outcomes
Learning outcomes can be aligned to rubrics for institution-wide
initiatives such as accreditation.
MagicMarker for iPad
Enables instructors to mark student progress toward learning
outcomes quickly, easily, and in real-time in fast-moving
classrooms
Polls for Canvas
Student response app (for iOS and Android) for real-time and
on-the-fly classroom polling
SpeedGrader™
Teachers can view, grade, initiate discussions, and provide
students with written, video, or audio feedback within one frame.
Grades
Assignments and quizzes can be scored by points, percentages,
letter grades, and complete/incomplete.
Groups
Ad-hoc groups allow users to form communities based on
teacher assignment or self-signup for collaborations, clubs, or
interest groups.
Chat
Synchronous audio, video, and text chat adds an extra
dimension to the learning experience.
Communication
Preferences
Users can opt to receive brokered notifications and messages
via email, text message, Facebook, or Twitter.
Mobile Access
Courses are accessible from browser-enabled mobile devices
and using Canvas mobile apps. Apps are available for the
iPhone, iPad, and Android, and can be downloaded from the
app store at no charge.
Internationalization
Supports English, Spanish, Russian, French, Portuguese
(Portuguese Brazil), Japanese, Chinese (Simplified), Arabic,
with German and Polish on the near-term product roadmap
Integrations
The standards-based, pluggable platform provides easy
integration with a wide variety of external technologies, systems,
tools, and services.
11 September 2014
Instructure, Inc.
10
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Canvas K-12 Features
Security
Independent security audits are scheduled annually and results
are released publicly.
Canvas Help Center
The Web-based support center and knowledgebase includes
links to Canvas Guides, video tutorials, FAQs, user-groups, and
release notes.
11 September 2014
Instructure, Inc.
11
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
3
Response to Technical Requirements/Sprecifications
Vendor response shall be in the format below. Vendor shall acknowledge their proposed service
meets each requirements or specification, and address each item in detail in their RFP response,
numbered and in the same order listed, with narratives and examples of how they will satisfy the
requirement/specification.
a) Vendor shall ensure that 90% of transactions occur in 3 seconds or less and 95% of
transactions occur in 2 seconds or less. The Vendor shall describe how they will monitor and
report.
The Canvas cloud architecture—built on Amazon Web Services infrastructure—provides unmatched
availability, scalability, and reliability. The Canvas architecture and the AWS infrastructure are fully
horizontally scalable providing virtually limitless capacity via the provisioning of additional resources.
Instructure’s Master Subscription Services Agreement guarantees 99.9% uptime and we utilize the
following best-of-breed solutions to ensure optimal transaction time and page loads:
•
Redundancy of computing resources with active monitoring for failure detection and
automated fail-over
•
Real-time performance tuning via Automated Provisioning of resources to respond to spikes
and peak usage times to minimize performance degradation
•
Data protection through data replication, backup/restore, and disaster recovery procedures
•
Load balanced application servers and aggressive data caching for superior web performance
•
Rolling release schedule of upgrades and updates, rarely incurring system downtime
b) The Vendor shall provide real-time monitoring with analytics (graphical and reports).
Canvas provides real-time system monitoring of system availability, database space available,
network, and infrastructure. Instructure continually monitors usage, system health, and security of
Canvas. Instructure uses a combination of internal and external monitoring systems for maximum
coverage, such as Zabbix, pingdom, and pagerduty, as well as some custom systems. This is in
addition to "monitoring" that may be thought of simply as user logging and regular internal and
external security audits.
c) The LMS service shall scale to at least 30 thousand subscribers in year 1 and allow a
scalability of up to 1.5 million subscribers over 4 years. The Vendor shall describe how the
service will scale to 1.5 million subscribers and how it will handle variable concurrency as
more classrooms move to a device per child.
The Canvas architecture and the AWS infrastructure are fully horizontally scalable providing virtually
limitless capacity via the provisioning of additional resources. Currently, the Canvas user base is
approximately 14 million users worldwide. Horizontal scalability enables Canvas to respond to usage
11 September 2014
Instructure, Inc.
12
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
spikes in real-time and to accommodate expanded, long-term usage. The Canvas "stack" is a
dynamic scaling web application built with our own automated scaling and automated provisioning
technology.
Canvas was selected by Cisco Networking Academy to power the “world’s largest classroom” (over 1
million students from 65 different countries). Cisco joins over 900 school districts, universities, and
colleges that have chosen Canvas as a learning partner.
One highlight of our hosting is the use of automated provisioning. Application servers are constantly
monitored individually for load and capacity information. When all application servers read a certain
load threshold, a new application is automatically provisioned and deployed. The Instructure
operations team also has the ability to schedule new application servers in advance in anticipation of
high load times, such as during the beginning and ends of semesters. For larger partners we may,
depending on size and performance requirements, dedicate application servers for specific clients.
Automated provisioning makes the most efficient use of computing resources through the early
detection and accommodation of usage spikes. When a spike is detected, server power is allocated
among multiple servers to ensure efficient operations even during peak usage times such as at the
start and end of academic terms. See Figure 5 for an example.
Without automated provisioning, resources have to be scaled to provide sufficient capacity for times of
peak usage. However, that extra capacity is largely wasted during the bulk of the year since peak
usage only occurs at particular times, at the start of a school semester, for example. If, on the other
hand, resources are scaled to average usage, peak usage times are then under-served and results in
frustrated users. This dilemma is eliminated with automated provisioning. Automatic provisioning
eliminates the costs of extra capacity while ensuring that sufficient resources are always available
when needed.
Figure 5. Instructure’s Automated Provisioning
11 September 2014
Instructure, Inc.
13
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
d) The Vendor shall have full weekly backups with incremental daily backups. The Vendor shall
provide for a 48-hour recovery from the loss of a data center including the loss of only 2 hours
of data. The Vendor shall describe their disaster recovery plan.
The Canvas platform has been architected to achieve an exceptionally low Recovery Time Objective
(RTO) and Recovery Point Objective (RPO). The goal for a disaster scenario for both RPO is 4 hours
and RTO is 24 hours. This RPO and RTO, as well as other RPO and RTO estimates provided in this
plan, are extremely conservative upper-end estimates. In actual practice, the Operations team
expects much lower RPO and RTO times.
Instructor, student, course, assignment database data is replicated asynchronously in near real-time
to a remote site. Nightly backups of every database are stored in third remote site. Static assets from
courses and assignments such as documents and other content files are stored on a scalable,
protected, geographically redundant storage system (Amazon S3). Multiple copies are stored by
Instructure which provide the backups.
Full details on Instructure’s disaster recovery plan is available in State of North Carolina Dept of
Public Instruction
e) The Vendor shall describe their hosting environment, including primary site location(s) and
disaster recovery location(s), internet connectivity, power management and site security.
Vendor shall describe the relationship between the primary site(s) and recovery site(s) and
any industry certifications that these facilities have achieved (e.g. Tier III/IV, SAS70, SOC1,
SOC2, etc.). If the hosting facilities are SAS 70 II compliant and/or compliant with SSAE 15
reporting standards, the Vendor shall include a copy of the most recent audit. If the Vendor’s
LMS service is hosted by a third party, the Vendor shall provide details of that hosting
agreement.
Canvas Cloud is hosted on Amazon Web Services’ cloud infrastructure. Amazon EC2 is currently
available in seven regions: US East (Northern Virginia), US West (Oregon), US West (Northern
California, and AWS GovCloud.
Canvas security is ensured on the Amazon Web Services’ Elastic Compute Cloud (EC2) and Simple
Storage Service (Amazon S3). Amazon Web Services (AWS) has successfully completed multiple
SAS70 Type II audits, and as of September 30, 2011 publishes a Service Organization Controls 1
(SOC 1) report, published under both the SSAE 16 and the ISAE 3402 professional standards. In
addition, AWS has achieved ISO 27001 certification, has been successfully validated as a Level 1
service provider under the Payment Card Industry (PCI) Data Security Standard (DSS), and has
completed the control implementation and independent security testing required to operate at the
FISMA-Moderate level. AWS continues to obtain the appropriate security certifications and conduct
audits to demonstrate the security of its infrastructure and services.
AWS datacenters are housed in undisclosed facilities. Physical access is strictly controlled both at the
perimeter and at building ingress points by professional security staff utilizing video surveillance,
11 September 2014
Instructure, Inc.
14
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
intrusion detection systems, and other electronic means. Authorized staff must pass two-factor
authentication a minimum of two times to access datacenter floors. All visitors and contractors are
required to present identification and are signed in and continually escorted by authorized staff.
AWS only provides datacenter access and information to employees and contractors who have a
legitimate business need for such privileges. All physical access to datacenters by AWS employees is
logged and audited routinely.
f)
The Vendor shall describe the architectural approach, infrastructure and operating
environments that are necessary to meet the stated recovery point and time objectives. In
addition tell us if the proposed solution exceeds those metrics.
Please refer to Appendix C “Disaster Recovery Procedures and Plan.”
g) Vendor shall describe their data archival policies and any data purge policies.
Canvas maintains all historical data in the Amazon cloud infrastructure; archiving or purging any
content is typically unnecessary. However, the Content Copy tool and Course Export tool can be used
to archive course content if desired.
h) The Vendor shall ensure that all data processed, stored and maintained in the LMS service
shall NOT leave the borders of the United States. This shall include all online storage as well
as data backups and archived data.
Yes, Instructure ensures that data from NCDPI will be processed, stored and maintained in the United
States, including online storage and data backups and archived data.
i)
The State retains the right to audit the physical environment where a service is hosted per the
vendor proposal. The Vendor shall describe the processes in place to allow this audit.
Canvas is hosted on Amazon Web Services and we would need to get permission from AWS to have
NCDPI audit the physical environment. We currently do not have a process in place to audit AWS
sites.
j)
The Vendor shall describe their process for employee background checks. Please include who
performs them, for which employees, and when the checks are performed.
All employees are required to under go a background check. In addition, Canvas complies with U.S.
federal law regarding Family Educational Rights Privacy Act (FERPA) and Children's Online Privacy
Protection Act (COPPA) and gives schools the tools they need to maintain compliance. All employees
sign a CIPA agreement.
k) The Vendor shall describe the process for handling non-public data at rest and non-public data
in motion.
Canvas is entirely at least 128-bit SSL-protected, ensuring that both inbound and outbound traffic,
including any sensitive or personally-identifiable information is encrypted and secured. Canvas does
not encrypt for data at rest.
11 September 2014
Instructure, Inc.
15
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Canvas provides a consistent, end-to-end security infrastructure responsible for protecting all content
provided in and through the Canvas system. Access to user information, courses, course content,
files, and more is restricted by enrollment type and specific permissions. These permissions are fully
configurable by the institution's administrators and can differ between districts, schools, and other
levels of institutional hierarchy.
l)
The Vendor shall describe the process for handling and notification of a breach of non-public
data.
Please refer to Appendix D “Canvas Security” for our handling of notification of a security breach.
m) The Vendor shall describe the handling of authorization for the various roles associated with
data access.
Access to Canvas information, features, and functionality is controlled by user authentication, user
accounts, and user roles. Canvas provides six predefined Canvas user roles with default
permissions—Admins (Canvas Administrators), Teachers, TAs (Teaching Assistants), Designers
(Course Designers), Students, and Observers/Parents. Institutions can modify the permissions of the
predefined user roles as well as create new user roles as needed.
Canvas provides a fine level of granularity of user-role based access control with over 70 account and
course-level permissions. A portion of the Permissions interface in the Canvas Administrator’s
account Settings tool is shown in Figure 2.
Figure 2. Permissions interface of the Administrator’s Settings tool.
11 September 2014
Instructure, Inc.
16
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Account Administrators are “super-users” with all permissions granted at the account and course
levels. Administrators can be restricted to sub-accounts with full administrative permissions limited to
the sub-account and the constituent courses. The “Manage permissions” permission allows that user
role to enable and disable (and optionally lock the setting) the permissions of other user roles as
shown in Figure 3.
Figure 3. Enabling, Disabling, Locking Permissions
n) The Vendor shall only allow remote access using industry standard network security
processes. The Vendor shall describe their processes.
Canvas supports centralized identity management and delegated authentication via integrations with
external identity providers (IdPs) including Lightweight Directory Access Protocol (LDAP), Active
Directory, Central Authentication Service (CAS), Security Assertion Markup Language (SAML) 2.0,
and Shibboleth. Canvas supports federated identity management and Single Sign-On (SSO) via
integrations with SAML, Shibboleth, and CAS. Additionally, user ID and password credentials from
any third-party system can be synchronized with Canvas-internal, local authentication via the Canvas
open API.
Canvas-internal authentication can be used alone or concurrently with any of the supported external
IdPs identified above. For example, when used concurrently with LDAP Canvas first presents user
credentials to the external IdP. If authentication fails, Canvas then looks up the credentials using its
internal authentication service. If authentication fails again, Canvas will deny the user login.
o) The Vendor shall describe security of data stored at the vendor’s site as well as any server
security policies. The service shall have undergone vulnerability and penetration testing.
Canvas is housed in Amazon Web Services, which meets the District’s minimum requirements for
information security. Amazon Web Services’ network security protects against:
11 September 2014
Instructure, Inc.
17
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
•
Distributed Denial Of Service (DDoS) Attacks - Proprietary DDoS mitigation techniques are
used. Additionally, AWS’s networks are multi-homed across a number of providers to achieve
Internet access diversity.
•
Man In the Middle (MITM) Attacks - All of the AWS APIs are available via SSL-protected
endpoints which provide server authentication. Amazon EC2 Amazon Machine Images (AMIs)
•
Automatically generate new Secure Shell (SSH) host certificates on first boot and log them to
the instance’s console. For data security, all Canvas data is transferred over an SSL-encrypted
connection through HTTPS. Canvas Cloud Edition encrypts all traffic with 128-bit SSL all the
time over Amazon S3 and EC2 servers.
•
IP Spoofing - Amazon EC2 instances cannot send spoofed network traffic. The AWS-controlled,
host-based firewall infrastructure will not permit an instance to send traffic with a source IP or
MAC address other than its own.
•
Port Scanning - Unauthorized port scans by Amazon EC2 customers are a violation of the AWS
Acceptable Use Policy.
•
Packet Sniffing - It is not possible for a virtual instance running in promiscuous mode to receive
or “sniff” traffic that is intended for a different virtual instance.
Extensive information about AWS network layer security can be found at
http://aws.amazon.com/security/ and in the Amazon Web Services: Overview of Security Processes
Whitepaper.
p) The Vendor shall describe the level of customer control on applying patches, upgrades, and
changes to the SaaS application and the notification process to be used.
Canvas is implemented as a true cloud-based LMS which is incrementally upgraded and updated on
an ongoing basis; there are no major releases in the traditional sense. Instructure does not assign
version numbers to any particular point-in-time implementation of Canvas. By definition and by virtue
of the cloud implementation model, our client institutions simply access and use the current production
implementation of Canvas.
Canvas “Hands-Free” upgrades and updates are part of Instructure’s comprehensive hosting services
and are included in the annual Canvas subscription fees. Instructure upgrades and updates Canvas
on a tri-weekly cycle, so that client institutions benefit from continuous product improvement, new
features, and extended functionality. Upgrade and updates are typically released to the Canvas
production environment every third Saturday morning. As warranted, Instructure will apply securityrelated bug fixes between the tri-weekly upgrade/update releases. Instructure’s rolling release
methodology rarely incurs any system downtime.
Instructure emails detailed release notes to institutions’ Canvas administrators in advance of the
release date (when the release package is deployed to the beta environment) describing the new
features, modified features, and/or bug fixes included in the release package as well as indicating if
any downtime is expected when the release is deployed.
11 September 2014
Instructure, Inc.
18
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Upgrades and updates are first deployed to Canvas beta environment prior to being implemented in
the production environment. All client institutions have access to the beta environment where users
can test drive and provide feedback about the upcoming/proposed changes.
With these agile development methodologies, Instructure is still sensitive to the needs of admins and
IT. Most changes are subtle and all changes come with proper amount of warning and often will
include an opt-in or opt-out aspect to larger development updates.
Detailed release notes are emailed to institutions’ Canvas administrators. General release notes and
screencasts are provided in the Canvas Community Product Forum in the Canvas Help Center at
https://help.instructure.com/forums/337224-product-release-notes. A screenshot of a portion of the
most recent Canvas product release note is shown in Figure 4.
Figure 4. Example of a Canvas Product Release Note
q) The Vendor shall describe the process for handling software defects.
Canvas applies an agile methodology with an integrated QA process to the design, development, and
maintenance of Canvas. The QA process certifies product functionality, reliability, and accessibility.
Every day during the three-week cycle, Canvas’s engineering team holds a “stand-up” meeting to
review progress and discuss any concerns. Engineers write automated unit and integration tests to
cover all new code that is written. In addition, all code changes are run through the full Canvas QA
test suite before they can be accepted into the main product. Code changes are closely reviewed and
must be peer-approved by other engineering team members before inclusion in the upgrade/update
package.
11 September 2014
Instructure, Inc.
19
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
After the three-week development cycle, all changes are deployed to an internal staging server for
additional QA testing. Canvas’s QA team reviews all associated tickets, uses black box testing of
affected components, and also test standard application workflows. Notes are made on the internal
tickets for these changes as needed. Any bugs that are found must be fixed during this QA period,
otherwise the change is pulled for further development.
Prior to release to the Canvas production environment, all upgrade/update packages are released to a
beta environment where the users of our client institutions can test drive and comment on new and
changed features and functionality.

Preliminary release notes are generated for the upcoming release and made available to all
users at http://help.instructure.com/forums/337224-product-release-notes and updated during
the QA process.

Current and past release notes for the tri-weekly Canvas upgrade/update releases are
available at http://help.instructure.com/forums/337224-product-release-notes.
•
Past security notices for Canvas are available on the Security Advisory Forum of the Canvas
Community at https://help.instructure.com/forums/20382721-Security-Notices.
r) The Vendor shall describe the major and minor release policy for the solution.
Please refer to Item p above for information about our agile development and the tri-weekly release
cycles.
s) The Vendor shall describe the processes for incident management, change management, and
release management.
Please refer to Item q above for a description of the incident management, change management and
release management.
t) The Vendor shall describe any user configurable settings.
With the agile development methodologies, Instructure is still sensitive to the needs of admins and
IT. Most changes are subtle and all changes come with proper amount of warning and often will
include an opt-in or opt-out aspect to larger development updates.
u) The Vendor shall describe the proposed solutions applications architecture.
The Canvas architecture is a single instance, multi-tenant system designed to scale to tens of millions
of users. The Canvas "stack" is a dynamic scaling web application built with our own automated
scaling and automated provisioning technologies. Canvas is developed using Ruby on Rails built on:
•
Ubuntu LTS operating system
•
Apache2 + Passenger web and application server
•
Cassandra and Redis NoSQL store and caching
11 September 2014
Instructure, Inc.
20
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
•
PgBouncer and PostgreSQL transactional database
Canvas’s multi-tiered architecture is shown in Figure 5. Canvas is hosted on the state-of-thetechnology cloud infrastructure provided by Amazon Web Services (AWS). The AWS services used to
host Canvas include Elastic Compute Cloud (EC2), Elastic Load Balancing (ELB), Simple Storage
System (S3), Elastic Block Store (EBS), Virtual Private Cloud (VPC), Simple Email Service (SES),
CloudFront, Identity and Access Management (IAM), DirectConnect, and CloudSearch. All application
nodes are hosted on the AWS EC2 and S3 infrastructure, making full use of the real-time redundancy
and capacity capabilities offered. Virtualization is provided by AWS EC2.
All data traffic in and out of Canvas is 128-bit SSL-encrypted. The AWS cloud infrastructure is SAS70
Type II audited, Service Organization Controls 1 (SOC 1) reported and published under both the
SSAE 16 and the ISAE 3402 professional standards, ISO 27001 certified, Level 1 service provider
under the Payment Card Industry (PCI) Data Security Standard (DSS), and has achieved FISMAModerate operation level. Instructure uses three AWS regions: the US East (Northern Virginia) Region
with 5 EC2 Availability Zones, the US West (Oregon) Region with 3 EC2 Availability Zones, and the
EU West (Ireland) Region with 3 EC2 Availability Zones.
The Canvas architecture is horizontally scalable, enabling it to respond to usage spikes in real-time
and to accommodate expanded, long-term usage. Canvas architecture also provides exceptional
resilience to and rapid recovery from component failure. The Canvas application, its media and file
storage, and its database are each independently redundant. If an application hosting node were to
fail, all traffic would transfer to living nodes. If load increases, Canvas's automated provisioning
system ensures that more hosting nodes are made available—either in response to increased load or
in anticipation of it—to handle it. The database and file stores are also horizontally scalable, adding
capacity for both additional storage and load as needed.
The tiers of the Canvas architecture—Load Balancers, Application Servers, Caching, Database,
Distributed File Store, and Rich Media Store—are described below.
11 September 2014
Instructure, Inc.
21
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Figure 5. Canvas Architecture
Load Balancers
Load balancers are deployed in pairs in an active/passive configuration. The active load balancer
handles all incoming requests and dispatches the underlying connection to available application
servers. The load balancer maintains a dynamic list of available application servers for dispatch.
Approximately every five (5) seconds the load balancer sends a heartbeat—a simple network
message—to verify that the application server is still up, available, and capable of receiving additional
work. The load balancer does not dispatch work to unresponsive application servers. This list of live
application servers is mirrored in near real-time to the passive load balancer. Load balancers are fully
monitored for load and potential failure.
Component Failure
The passive load balancer continuously verifies that the primary load balancer is available and
servicing requests by sending a heartbeat every second. When the primary load balancer stops
responding to heartbeat checks, the passive load balancer:
11 September 2014
Instructure, Inc.
22
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
1.
2.
3.
Assumes the IP address of the failed primary load balancer
Promotes itself as the primary load balancer by making an API call
Sends an alert to the Network Operations Center (NOC)
Capacity
Additional capacity can be added to the load balancing tier when the monitoring system detects load
saturation. Load balancers are always added in active/passive pairs to maintain high availability.
Additional load balancer pairs are allocated IP addresses, then registered for DNS round-robin
lookups.
Updates/patches
Load balancer operating systems are updated regularly with security patches. These are done one at
a time, so there is no interruption in servicing clients.
Application Servers
Application servers process incoming requests from the load balancers. They are responsible for
executing the business logic, rendering HTML, and returning some static assets to the web browser.
Component Failure
Application servers are constantly monitored by the load balancers via a heartbeat mechanism. When
an application server stops responding to heartbeat checks, the load balancer will remove it from the
pool of servers to send requests to. The load balancer will keep checking the application server until it
starts responding again, at which point it will start sending new traffic.
Application servers do not persist any state, so losing one does not affect the service directly.
Because there is no shared state between application servers, it is quick and easy to deploy new
ones when necessary.
Capacity
Application servers are constantly monitored individually for load and capacity information. When all
application servers read a certain load threshold, a new application is automatically provisioned and
deployed. The Instructure operations team also has the ability to schedule new application servers in
advance in anticipation of high load times, such as during the beginning and ends of semesters. For
larger partners we may, depending on size and performance requirements, dedicate application
servers for specific clients.
Updates/patches
Application server operating systems are updated regularly with security patches. These are done one
at a time, so that there is no interruption in servicing clients.
11 September 2014
Instructure, Inc.
23
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Upgrades to the application itself are also done in a way that does not affect the clients using the
service.
Caching
The caching layer provides a substantial performance optimization. A healthy cache means that the
application servers need to make fewer trips to the database, speeding up response times. The
caching layer is made up of several machines running memcached. Data is spread out across all
machines. All the data stored by the cache is ephemeral - therefore losing a caching node does not
include data loss.
Component Failure
The cache servers are constantly monitored. When a cache server dies, a new one is provisioned and
deployed to take its place. While it's down, the data that would have been stored on it is simply
retrieved from the database instead. This may have a temporary performance impact on the service
until the new cache node is deployed.
Capacity
Cache servers are completely memory based. Memory usage is monitored continuously by
Instructure, and when the cache hit rates falls below an acceptable threshold, new cache servers are
provisioned and deployed.
Updates/patches
Cache server operating systems are updated regularly with security patches. These are done one at a
time, so that there is no interruption in servicing clients.
Database
Important course and user data is stored in relational databases. The databases are partitioned by
institution for performance and data isolation reasons. Each institution has a pair of databases: a
Primary and a Secondary in a separate location. The Primary replicates all data to the Secondary in
near real-time. A complete backup is also taken every 24 hours and stored in a third geographically
separate location
Component Failure
On failure of the Primary database, the Secondary will be promoted to Primary and a new Secondary
database provisioned and deployed. Upon failure of the Secondary database, a new Secondary
database is provisioned and deployed. In the unlikely event of simultaneous component failure or data
corruption, the most recent daily backup will be used to create a new database pair. Please refer to
the Disaster Recovery Plan for more details and a discussion of RPO and RTO.
Capacity
11 September 2014
Instructure, Inc.
24
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Databases are constantly monitored for resource usage and response time. If either database begins
to reach peak load, it will be migrated to a server with higher resources. Our experience and testing
show that this "scaling up" is adequate for most institutions.
Updates/patches
Since the databases together form a "single point of failure" for a given population of users, updates
to each system are performed carefully and with planning. Generally, one database will be updated at
a time. First the Secondary database will be updated, then promoted to be the Primary, then the (new)
Secondary will be updated.
Distributed File Store
Digital assets like files, documents, and learning artifacts are stored outside the database in a
separate and scalable service. Metadata and access control are stored and maintained within the
relational database. The architecture of this storage tier is very similar to the Instructure architecture
outlined in this document. Additional capacity and scaling is performed independent of the other tiers
on an as-needed basis. Instructure has partnered with Amazon S3 to provide industry-proven scaling,
reliability, and data integrity.
Rich Media Store
Rich media like videos, audio recordings and webcam captures are stored outside the database in a
separate and scalable service. Metadata and access control are stored and maintained with the
relational database. The architecture of this media tier is very similar to the Instructure architecture
outlined in this document. Additional capacity and scaling is performed independent of the other tiers
on an as-needed basis. Instructure has partnered with Kaltura to provide industry leading storage,
streaming, and recording of digital media.
v) Vendor shall describe the overall security architecture of the proposed LMS service.
Please refer to Appendix D “Canvas Security.”
w) The Vendor shall describe how the state will get its data back in a form that can be used in the
event of contract termination or expiration or if the State desires a different service.
During the term of this agreement and for 3 months after expiration or termination, Customer may
export the Customer Content through the API or by using the export feature of the Service.
x) The Vendor shall integrate with Pearson PowerSchool. Additional information provided in
Attachment 5. This integration shall include course/class enrollment synchronization and course/class
section creation using designated master content. Additionally, PowerSchool integration shall include
grade book synchronization. The vendor shall describe their integration in detail including
synchronization and update schedules.
The Canvas implementation service includes the configuration and testing of our turn-key integration
with PowerSchool (version 7.2 or later) for one-way creation and synchronization of teacher and
11 September 2014
Instructure, Inc.
25
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
student accounts, courses, sections and enrollments. The scheduled synchronization generally occurs
nightly at 2:00 AM MST/MDT but can be modified to accommodate the clients needs.
Instructure is committed to and actively developing grade book synchronization as part of our
PowerSchool solution. This future solution will allow teachers to selectively choose which
assignments to “Post to SIS” and to synchronize the selected assignments and their associated
grades to PowerSchool on demand without the need for manual export/import.
y) Vendor shall describe how they will handle teachers and students who teach or are enrolled at
multiple LEAs.
Canvas offers several options for supporting teachers and students who teach or are enrolled at
multiple LEAs. In the event one or more of the following attributes are true, Canvas may support
allowing students and teachers to use their common credentials regardless of which LEA they are
accessing:


Teachers and students retain a single staff ID or student ID for use at the multiple LEAs
LEAs use a common method of authentication (e.g. LDAP, Active Directory) or single sign-on
(SSO) such as CAS, SAML, Shibboleth and ADFS.
In addition, Canvas fully supports the (likely) less favorable option of allowing students and teachers
to use and maintain different credentials for each LEA.
z) The Vendor shall integrate with the NC Learning Object Repository. Additional information provided
in Attachment 4. This integration shall include learning object insertion from NCLOR directly from
course management interface with objects embedded in the system with links to the NCLOR. Users
hall be able to search NCLOR by keyword, standard, title, grade and subject. The Vendor shall
describe their integration.
Canvas supports user-authenticated integration with any EQUELLA instance (including NCLOR) as a
core integration allowing users to search and link to EQUELLA content via an EQUELLA option in
Canvas’ Rich Content Editor. The Canvas EQUELLA integration allows users to search by any field
made available in the EQUELLA configuration. Configuration of the Canvas EQUELLA integration
requires minimal effort as described in the Canvas help guide.
11 September 2014
Instructure, Inc.
26
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
aa) The Vendor shall integrate with the NC Education Cloud Identity & Access management Service
for authentication. Additional information provided in Attachment 3. Vendor shall describe in detail
how they need to interact with the NC IAM service, e.g. SAML or LDAP could be used for
authentication and/or authorization in addition to providing updates to user attributes. How would
teacher/course assistants be handled? The Vendor shall describe how it will provide role-based
access controls with appropriate authentication rules as mandated by the State of North Carolina.
These rules may be viewed at the following internet address:
http://www.scio.nc.gov/mission/itPoliciesStandards.aspx
The Vendor shall have role-based password policy management for application controlled accounts.
This shall include a 90-day password change policy.
Canvas’ only password requirement for Canvas-controlled passwords is that the password must be at
least six characters. For more robust password policy management, we recommend leveraging
Canvas’ support for external authentication (e.g. LDAP, Active Directory) or single sign-on (SSO) such
as CAS, SAML, Shibboleth and ADFS.
bb) The Vendor shall deliver to NCDPI a Technical Implementation Plan within the first 30 days
following the RFP award. The plan shall include specific, detailed tasks and responsibilities.
Canvas is a SaaS based Learning Management System; we provide a Customer Success Managers
(CSMs) to serve as the primary points of contact for NCDPI during the implementation and after.
11 September 2014
Instructure, Inc.
27
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
CSMs work directly and proactively with client institutions to ensure that clients’ questions are
answered, to communicate information in an effectively and timely manner, to coordinate access to
Instructure’s resources, and to provide overall account management. CSMs communicate with client
institutions by phone, email, web conference, and chat.
Canvas will work with the District to meet its timeline and schedule requirements. Please refer to
Table for descriptions of Instructure’s implementation services. NCDPI will have a dedicated
Customer Success Manager that will continue to be available for weekly calls and updates.
Table 3 outlines the Instructure’s typical implementation plan and timeline for new client institutions.
The typical timeframe for an implementation and full migration of legacy LMS content falls in 4- to 16week range. The exact timeline for a particular implementation depends on whether the institution will
be utilizing API functions, SIS imports, identity provider options, and the availability and expertise of
resources within the client institution.
Table 3. Implementation Plan
Action Item
Responsible Party
Contractual Agreement
Milestone: Signed Contract
Assessment / Inception Phase
Milestone: Assessment / Inception Completed
 Provide implementation checklist in prep for call
Instructure
 Kickoff / planning call
Instructure & Client
 Introduce implementation team
Instructure
 Finalize implementation checklist
Instructure & Client
 Customize project plan to fit institution
Instructure
 Share overall project plan (provide login)
Instructure
 Create migration plan for instructors and content
Instructure & Client
 SIS integration
Instructure & Client
Initial Testing - Test Cluster
Milestone: Test Cluster Creation
 Create institution test cluster
Instructure
 Configure and test authentication
Instructure & Client
 Provide branding information to institution
Instructure
11 September 2014
Instructure, Inc.
28
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Action Item
Responsible Party
 Configure and test SIS import
Instructure & Client
 Test initial course migrations
Instructure
Training
Milestone: Trainings Completed
 Set up user training system
Instructure
 Administrator training
Instructure & Client
 Support Setup training
Instructure & Client
 Instructor/User training
Instructure & Client
 Ongoing organizational training
Client
Set Up Support
Milestone: Support Structure In Place
 Determine support structure
Instructure & Client
 Configure Zendesk account
Instructure
 Provide customer account for Zendesk
Instructure
 Setup escalation paths
Instructure & Client
Build Out Production
Milestone: Build Out Phase Completed
 Create production instance
Instructure
 Setup branding on production instance
Client
 Setup authentication (Active Directory, LDAP,
SAML, CAS)
Instructure
 Configure integrations (see optional integrations
list)
Instructure & Client
 Enable required integrations
Instructure & Client
 Migrate course content
Instructure & Client
 Configure cross-listed courses
Instructure & Client
 Configure accounts and sub-accounts
Instructure & Client
 Setup roles and permissions
Client
 Add any account level learning outcomes
Client
11 September 2014
Instructure, Inc.
29
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Action Item
Responsible Party
Finalize Courses and Ready for Go Live
Milestone: Validation & Acceptance
 System hierarchy completed?
Instructure & Client
 Users and permissions set?
Instructure & Client
 Integrations completed?
Instructure & Client
 Training completed?
Instructure & Client
 Instructor's courses ready?
Instructure & Client
 Support ready?
Instructure & Client
Optional: Integrations
Milestone: Integrations (if any) Completed
 Additional SIS integration?
Instructure & Client
 Course content providers?
Instructure & Client
 Media provider?
Instructure & Client
 Additional authentication?
Instructure & Client
 3rd party tools?
Instructure & Client
 Plagiarism checker?
Instructure & Client
 Quiz/testing tools?
Instructure & Client
 Conferencing tool?
Instructure & Client
 Clicker solution?
Instructure & Client
cc) The LMS service shall provide a mobile solution with greater than 95% functionality of the web
version.
Canvas mobile apps provide a full, interactive user experience. Canvas is available as a native app
for iOS and Android. Canvas apps for IOS and Android provide exceptionally rich user experiences on
smart phones and tablets as shown in Figure 6 and Figure 7. Canvas also offers a SpeedGrader app
for the I-Pad, as shown in Figure 8.
11 September 2014
Instructure, Inc.
30
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Figure 6. Canvas by Instructure for iOS
Figure 7. Canvas by Instructure for Android
11 September 2014
Instructure, Inc.
31
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Figure 8 SpeedGrader for iPad
Canvas mobile apps provide:

Instructors and students with the functionality needed to access and engage in the teaching
and learning experiences of Canvas courses, anytime and anywhere
11 September 2014
Instructure, Inc.
32
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14









A clean, intuitive interface for students to submit assignments, take quizzes, participate in
discussions, and other learning activities
Communicate privately through conversations, collaborate and complete assignments through
Discussions, and also give feedback and ask questions through submission comments.
Use mobile video to make media comments for a stronger interaction between instructor and
student.
Critical interactions are supported, including learner-to-content, learner-to-instructor, and
learner-to-learner interactions through tools adapted especially for small devices.
Assignment submissions from most cloud-based mobile apps including Dropbox, SkyDrive,
and Google Drive
The Grades tool for users to view their graded assignments, assessments, and other
coursework
Zooming capabilities and utilizes standard mobile device navigation and interaction techniques
such as finger-swiping for paging, pull-up and pull-down menus, and tapping for item selection.
A tutorial “training camp” when users open the app for the first time.
Access to external IMS Learning Tools Interoperability (LTI) compliant tools
dd) The LMS service shall work with all Vendor supported web browsers: Safari 7+, Chrome 35+,
Firefox 28+, IE 10+
Canvas supports the last two versions of every browser release. We highly recommend updating to
the newest version of whatever browser you are using as well as the most up-to-date Flash plug-in.
As of August 28, 2014, we support the following desktop browsers and Flash versions:
•
Internet Explorer 10 and 11
•
Chrome 36 and 37
•
Safari 6 and 7
•
Firefox 30 and 31 (Extended Releases are not supported)
•
Flash 12 and 13 (for recording or viewing audio/video and uploading files)
•
Respondus Lockdown Browser (supporting the latest system requirements)
ee) The LMS service shall support Google Chrome OS, Chromium and Chromebooks.
Canvas works across all major browsers across platforms, leveraging the best and newest capabilities
they provide. Canvas is equally compatible with all supported browsers. Java is not required. Flash is
used minimally.
11 September 2014
Instructure, Inc.
33
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
ff) The LMS service shall be touchscreen compliant and platform independent; must be accessible
from iPad 2 and later devices in addition to Android 4.0 and later devices. Vendor shall include a list of
tested devices.
Canvas testing is completed on all supported desktop browsers, Canvas apps for supported iOS
devices (i.e. iPad, iPhone/iPod) and Canvas apps for standard Android phone and tablet devices
including Kindle Fire. In addition, we actively monitor and work to remedy issues reported when
related to the user experience when using a standard mobile browser.
Canvas provides four native mobile applications free for download on both phones and tablets. We
are actively improving our native mobile applications to support as many Canvas features as possible.
Please note that mobile applications are only supported in English at this time.
•
Canvas by Instructure (iOS 7.0+, Android 4.0+). This app provides access to Canvas for both
instructors and students while on the go. Depending on your device, not all Canvas features
may be available on the app at this time. View Canvas mobile features by version and device.
•
MagicMarker (iPad only, iOS 7.0+) This app is specifically designed for instructors to assist
them with standards-based learning. Syncs with the Learning Mastery Gradebook.
•
Polls for Canvas (iOS 7.0+, Android 4.0+). This app is the easy to way for instructors to collect
student opinion in their classrooms without any extra devices.
•
SpeedGrader™ App (iPad only, iOS 5.0+). This app is specifically designed for instructors and
allows them to grade student submissions on the go. Syncs with SpeedGrader™ and the
Gradebook.
gg) The LMS service shall be HTML5 only; it shall not require Java, Flash, or Silverlight.
Canvas is built in web standards, including HTML5. Canvas supports HTML5, CSS3, and JavaScript.
HTML5 code can be entered directly in the HTML view of the Rich Content Editor. Canvas requires
minimal use of Flash and does not require Java or Silverlight.
hh) The LMS service shall provide an automated course copy tool.
Virtually any Canvas course and any type of
Canvas course content can be copied as well
as reused as masters and templates for
creating other course content. Canvas’s
integrated tools—“Import Content into this
Course” and “Export Course Content”—that
make it easy to import, export, and copy
courses. The Import Content tool imports
legacy LMS courses, Common Cartridge
courses, and QTI assessments and question
banks. The Import Content tool also copies
Canvas courses and course content. In
11 September 2014
Instructure, Inc.
34
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
general, the import and copy processes comprise four simple steps:
1. Select the Content Type
2. Choose the Source File
3. Specify options for the content type
4. Click Import
The Import Content tool maintains a list of jobs and their statuses as shown in Figure 9.
Figure 9. Import Content Processed Jobs
The Export Course Content tool is even easier. Select “Course” to export the current course or “Quiz”
to export one or more of the quizzes in the current course, then click Export. Because it can take a
while to export large courses, you can leave the Export Course Content tool and Canvas will notify
you by email when the export is complete and ready for download.
ii) The LMS service shall provide automated enrollment and course creation.
Canvas supports batch and near real-time integration with enterprise level, student information
systems (SIS), and other external systems for the data interchange of institution data including
registration, course creation, users, and enrollment information. The integration framework supports
the following data imports via a fully automated, batch-enabled API:

Users (Students, Instructors, etc.)

Accounts (Campuses, Colleges, Departments, etc.)

Terms (Semesters or other types of terms)

Courses

Sections

Enrollments (Student, Teacher, TA, Course Designer, Observer)
11 September 2014
Instructure, Inc.
35
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14

Groups

Group enrollments/memberships

Cross-listing of courses and sections
In each institution’s account, the full organizational hierarchy is recreated through the SIS integration.
These sub-accounts of the institution reflect the different colleges, departments, programs and
courses unique to each school. This concept of reflecting the organization of each institution is applied
to sharing content, aligning learning outcomes, reporting, and reusing assessment rubrics.
Through the Canvas open API, institutions can control courses, users, and student enrollments at a
very fine level of granularity. For ease of integration, Canvas also provides bulk enrollment endpoints
(CSV and IMS Enterprise XML) for various SIS systems. All SIS endpoints are capable of importing
enrollment data in both real-time and in batches in addition to natively supporting cross-listed courses.
jj) The LMS service shall provide course archival and retrieval including: archive of all course data
including grade book, recovery of only selected modules within a course, and import of content from
an archive. Vendor shall describe in detail how course archival will function. Please include options for
Vendor provided archival and retrieval and options for LEAs and Charter Schools to archive
themselves. Please discuss access, storage and timing.
The Amazon cloud infrastructure supporting Canvas provides auto-archiving of student data. Any data
that enters the Canvas platform is automatically saved redundantly across several servers and data
centers. Data backups occur in real-time and require no specific intervention or request. In addition to
the live replication provided by the Amazon infrastructure and Canvas implementation, Instructure
routinely backs up Canvas databases and files for storage off-site and off of Amazon’s infrastructure,
providing complete redundancy of all data and eliminating any single point of failure. Elements are
always available until the client asks for archived materials to be deleted.
In addition, Canvas includes the Course Copy tool.
kk) The LMS service shall have complete log files and audit trails for policy enforcement that detail
who has access and/or modified which data, made or approved requests (and when), and cleanly
tracks how a user moved through the system. Log data shall be available in user reports (see below),
and access to the raw log data shall also be available.
Canvas provides real-time system monitoring of system availability, database space available,
network, and infrastructure. Instructure continually monitors usage, system health, and security of
Canvas. Instructure uses a combination of internal and external monitoring systems for maximum
coverage, such as Zabbix, pingdom, and pagerduty, as well as some custom systems. This is in
addition to "monitoring" that may be thought of simply as user logging and regular internal and
external security audits.
Administrators do not have open access to the Canvas database. Instead, the Canvas paradigm
favors data access via an open API as opposed to direct database access:
11 September 2014
Instructure, Inc.
36
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
While the Canvas API paradigm requires a trade-off, we decided that the benefits of direct access
were trivial compared to the more potent benefits that all our customers gain from our cloud-native
architecture. For example:






Canvas's built-in disaster recovery with multiple geographic redundancies means that there is
no "one" database. The Canvas API can potentially map SIS updates to several data stores in
lots of places.
The API allows greater control and performance guarantees of the system for all users,
regardless of simultaneous connections.
Our approach is more robust in that it allows us to update Canvas and even modify the
underlying database schema without breaking your custom integrations (SIS or otherwise).
Since the mechanism for updating data is so well defined, we help users avoid accidental
modification of the LMS data store, and the fun ramifications those might incur. I'm sure this
has never happened to you, but we have to be safe for all our customers.
Many of our clients have SIS systems that are 1) not internet accessible, or 2) not
SQL based. Our approach works for all customer needs.
If our out-of-the-box approach is not ideal for your situation, we do offer another path: You can
open up a secure and authenticated ODBC connection to your SIS database, and we have an
add-on product that can query your database and update Canvas accordingly.
ll) The LMS service shall have detailed user activity reports that include, but are not limited to, time
spent per question on assessments, time spent adding/changing content, completed activities.
Canvas Analytics analyses, provides statistics on, and reports grades per one or more students, one
or more assignments, one or more categories, and for the entire Gradebook. Using Canvas Analytics,
faculty can view all of these things in a very granular way.
11 September 2014
Instructure, Inc.
37
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Figure 10. Canvas Analytics: Course View
Figure 11. Analytics Course View: Student Section
Course Analytics enable admins and faculty to:
•
Predict how students react to course activities.
•
See which students are at-risk and need help.
•
Evaluate the effectiveness teaching strategies.
•
Quickly view of students’ progress.
11 September 2014
Instructure, Inc.
38
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Canvas analytics displays both class and student progress reports in the Student Summary for the
individual student see Figure 12.
Figure 12. Student Summary Information
The summary information includes the student’s name [1], the student’s current total of the grade [2],
and the name of the course [3]. A message can be sent to the student by clicking the envelope icon.
Use the arrows to step through the course roster or use the drop-down menu to select a particular
student [4].
1.1.1
View Activity
Figure 13 shows the Activity section of the Analytics Individual Student view.
Figure 13. View Activity
The individual student’s participation is shown by date on the x-axis and the number of activities on
the y-axis. To view the details, hover over the bar on the graph. The blue bar indicates the number of
page views and the orange bar indicates if the student took action on a page or participated in the
course same way.
1.1.2
View Communication
Figure 14 shows the Communication section of the Analytics Individual Student view.
Figure 14. View Communication
11 September 2014
Instructure, Inc.
39
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
The speech bubbles represent the conversations between instructor and student. To view the details,
hover over the speech bubbles to view the date the conversation took place and how many messages
were sent. The orange speech bubbles indicate the date of students sending messages to instructors
[1]. The blue speech bubble indicates the date of instructors sending messages to students [2].
1.1.3
View Assignments
Figure 15 shows the Assignments section of the Analytics Individual Student view.
Figure 15. View Assignments
The Assignments section identifies which assignments the student has or has not submitted. Each
row represents an assignment. The diamond indicates the due date and the bar is when the
assignment was submitted. Green means that the assignment was submitted on time. Yellow
segment means that the assignment was submitted late. Red means that the assignment was never
submitted. Gray diamonds are assignments without due dates, but have submissions.
1.1.4
View Grades
Figure 16 shows the Grades section of the Analytics Individual Student view.
Figure 16. View Grades
Each bar represents an assignment. The thin whisker extends from the minimum score for the
individual in the course to the maximum score. The wider bar extends from the 25th percentile to the
75th, with the median marked. The individual student’s score is marked with a dot. Assignments
submitted on time are represented by a green dot. Assignments submitted late are represented by a
yellow dot. Assignments not turned in are represented by a red dot.
11 September 2014
Instructure, Inc.
40
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
mm) The LMS service shall allow for copying of one piece of content from course to course and
maintain NC Learning Object Repository links.
Canvas Import Content feature allows users to browse and select one or multiple content items (or the
entire course image) from another course. NCLOR links copied from the source content items are
copied and fully functional.
nn) The LMS service shall provide data dumps/snapshots on demand for local backup purposes.
Canvas does not currently provide data dumps or snapshots on demand; however, it is an item that
we are discussing and we would be happy to discuss this with NCDPI.
oo) The LMS service shall provide a grade book. The grade book shall have user defined
perassignment weights. It shall have user-defined scales, including number, letter and plus/minus
options. The grade book shall have user defined categories and subcategories. It shall support
weighted scales by category scores. It shall support mastery/non-mastery grading (pass/fail).
The Canvas Gradebook is automatically generated and updated based on course assignments,
assignment groups, and assessments which are directly linked to the Gradebook and its integrated
feedback features. In the Gradebook, you can view the roster by all or selected sections and by
concluded enrollments. The Gradebook can be sorted by individual grade book item columns. In the
SpeedGrader, assignments can be sorted by student name, submission status, or submission
date/time. Gradebook features include:
11 September 2014
Instructure, Inc.
41
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
•
The Gradebook contains columns for percentages by weighted Assignment Groups and for
Total Grade percentage. Canvas Analytics provides statistical analysis and graphical
representation of grades.
•
The Gradebook interface provides the Upload Scores and Download Scores features for the
import and export of grade data in CSV format.
•
The Gradebook supports calculated columns using data from multiple columns with a variety of
functions.
•
Calculated columns are based on weighted assignment groups for the associated individual
grade book items/columns. There is no maximum of calculated columns.
•
The View Grading History function in the Gradebook supports versioning/ audit history for grade
changes.
•
The Mute Assignment feature in the Gradebook allows the instructor to control when the grades
and feedback for a particular assignment can be viewed by students.
Figure 17. Faculty View: Gradebook
•
Grading Schemes determine the data formats, rounding, and decimal options. In the
Gradebook, the Set Default Grade feature and the Curve Grades feature, shown in Figure 18,
can be used for each gradebook item column.
11 September 2014
Instructure, Inc.
42
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Figure 18. Curve Grades Feature in the Gradebook
pp) The LMS service shall have conditional release for mastery including complex Boolean logic that
supports both AND and OR operations.
Canvas does not currently support Boolean logic for conditional release. Canvas Modules allows
instructors to set condition releases. Canvas Modules allows teachers to set a quiz to become
available only after a specified score is received on another designated quiz. Administrators and
instructors can sequence Modules by defining criteria and prerequisites. Modules can be locked until
a given date or until students satisfy defined prerequisites. For example, an instructor can specify that
a module remain locked until students have achieved 75% or higher on a review quiz. Using dragand-drop, instructors can easily re-sequence the content of Modules.
Figure 19. Course Modules
11 September 2014
Instructure, Inc.
43
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
qq) The LMS service shall provide analytics for administrators, teachers, students and parents to
include reports for the following scenarios:
i.
Which Algebra I students are failing Module 1?
At the class level, the instructor, principal or other custom roles can identify failing students using the
Gradebook or ‘Message students who..’ (feature described in the response to question ii below).
Data identifying Algebra I students failing Module 1 across all Algebra I courses can be exported
programmatically using the Canvas API providing the modules and assignments used in the courses
use common naming conventions.
ii.
How many students have not met the conditional release parameters to release the next
module?
Canvas’ ‘Message students who..’ feature provides the quickest actionable route to identify students
who have not met conditional release requirements. This feature is available for every assignment,
quiz/test or graded discussion via the gradebook and also directly from the quiz interface. Options
include messaging or simply identifying students who a) have not submitted, b) haven’t been graded,
c) scored less than or d) scored more than.
In addition, the Modules Progress Report makes it very easy for teachers to quickly identify student
progress and completion.
11 September 2014
Instructure, Inc.
44
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
iii.
When was the last time a parent logged in?
The People page in each course shows the date/time of most recent activity (including login) for all
enrollments including observing parents. In addition, the Access Report (accessible by viewing a
particular enrollee) provides a detailed log of the user’s activity in the course. In addition to accessing
these course-level reports, administrators, principals, or an custom administrative role can view a
detailed access log of the parent or user’s activity across all courses in which they are enrolled.
iv.
How many teachers have not entered grades in the last 24 hours? Or the last 7 days?
The Canvas API supports the export of data to support just about any reporting use case that may not
already be support in Canvas reports or analytics. For this specific use case (i.e. identifying teachers
who have not entered grades in the last x hours or days), the ‘Query by grader’ or ‘Query by course’
API calls can be used to gather the appropriate data. In addition, Instructure’s Professional Services
team is skilled in custom report development made available via Canvas’ existing reporting
architecture.
rr) The LMS service shall allow content/images to be shared between courses, including accessing
content from another course, importing content from a course archive and linking to shared content
(NOT a copy).
Canvas Import Content feature supports import from courses, course archives, master courses and
repository courses. The Import Content feature allows users to copy an entire course image or to
browse and select one or multiple content items (or the entire course image) from another course.
11 September 2014
Instructure, Inc.
45
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
In addition to Canvas's existing capabilities to support course management, replication, and content
sharing, Instructure is actively developing a new Learning Object Repository (LOR) to enable
educators to share high-quality learning materials with their peers worldwide. With the ability to
discover content easily—both within a institution or with educators around the world—educators will
easily be able to create engaging courses without spending countless hours creating materials from
scratch. The LOR will:





Help educators quickly import materials to create high-quality, engaging courses
Enable educators to rate the available materials, allowing the highest quality tools to “rise to
the top” based on the ratings from the community
Foster a community of instructional innovation and collaboration by encouraging sharing and
remixing of faculty-authored materials
Support institutional management of curricula for maximum efficiency and reusability
Integrate tightly with the Canvas LMS, enabling teachers to seamlessly add courses, lesson
plans and other materials directly to the LOR as they create them, so sharing materials is
quick and easy
The Canvas LOR is scheduled release in Fall 2014 and will focus on the sharing, finding, and
remixing of course content by teachers and designers within a institution.
11 September 2014
Instructure, Inc.
46
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
ss) The LMS service shall allow the sharing of student submitted content.
Canvas supports the collaboration or sharing of student work. Canvas leverages technologies like
Google Docs and EtherPad allow multiple users to work together on the same document at the same
time. Collaborative documents are saved in real-time, meaning a change made by any of its users will
be immediately visible to everyone.
Canvas Collaborations. Groups can share content areas using web-based tools such as wikis and
blogs that users are already familiar with. Users can use resources like Google Docs or EtherPad to
work collaboratively on tasks like group papers or note-taking. Collaborations provide a convenient,
common work space to keep track of those collaborative activities, all without the need to exchange
personal email addresses.
Figure 20. Canvas Collaborations interface.
tt) The LMS service shall allow peer review of student submitted works.
Canvas allows peer review annotations on submissions of online assignments. Instructors can assign
students to peer review another student's work.
11 September 2014
Instructure, Inc.
47
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Figure 21. Peer Review Notification
uu) The LMS service shall support co-teachers.
Canvas supports co-teaching capabilities. With Canvas co-teachers have complete access to the
course materials, assignments, quizzes, discussions, chats, announcements, and more. All of the
material is in a single location and accessible to the teachers.
vv) The LMS service shall have Learning Tools Interoperability (LTI) support for integration of third
party content development tools, including, but not limited to, SoftChalk Cloud and Kaltura. The
vendor shall provide a list of tested LTI services.
Canvas provides a standards-based platform with an open API and an extensive set of supported
third-party integrations. In 2013, Instructure became the only LMS to offer “one-click” installation of
IMS Learning Tools Interoperability (LTI) compliant tools and services, when it announced the
integrated Canvas App Center. The Canvas Edu App Center (http://www.eduappcenter.com) is a
rapidly-growing app library with over 140 apps providing interactive resources, content repositories,
assessment tools, social media, and other digital learning and teaching resources including SoftChalk
Cloud and Kaltura. Table 2 shows a partial list of the third-party integrations that Canvas supports.
Note: Tools and services denoted with an asterisk (*) are provided and/or supported by Canvas at no
additional cost. Canvas support for integrations with the non-asterisked third-party tools and services
is included at no additional cost but institutions would need to already have or need to obtain licensing
for those products from their respective vendors.
Table 4 Partial List of Third-Party Integrations Support
Content/Tool/Service
Description
ARES
Library e-reserve and copyright management system
Box
Content management and collaboration tools
11 September 2014
Instructure, Inc.
48
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Content/Tool/Service
Description
ConnectEdu CoursEval
Course evaluation, analysis, and tracking
Dropout Detective
Student retention data aggregation and analysis
EQUELLA
Content management and digital repository
Facebook*, Twitter*, and
LinkedIn*
Social networking site
Google Drive* and
EtherPad*
Creating, editing, storing, printing, and sharing documents,
spreadsheets, and presentations
Canvas App Center IMS
LTI-Compliant Tools and
Services
Over 130 supported LTI-compliant tools and services including
Mahara (ePortfolio), Cengage Learning (content development),
Campus Pack (ePortfolios, blogs, wikis), SoftChalk Cloud (openlicensed learning resources), WikiSpaces (education wikis),
WordPress (blogs), and Khan Academy (courses). Please refer
to the Canvas App https://www.eduappcenter.com/ for a
complete listing
Kaltura*, ShareStream,
Ensemble Video
Media management, providing audio/video recording, and
streaming
McGraw-Hill Campus
Digital learning resources
McGraw-Hill Connect
Online learning assignment and assessment solution
Pearson MyLabs
Interactive courses, content, and assessments
Respondus
Assessment development, management, and publishing and
LockDown browser
SCORM Cloud
Course and content standards conversion
Scribd* and Crocodoc*
Online electronic document publication and sharing service
providing inline document previews
SoftChalk and SoftChalk
Cloud
Content development and management
SonicFoundry MediaSite
Enterprise webcasting, lecture capture, and hybrid event platform
Student Information
Systems (SIS) and
Human Resources
Information Systems
(HRIS)
Ellucian (formerly SunGard Banner or Datatel Colleague),
PeopleSoft, Jenzabar, CampusVue, Poise, PowerSchool,
CampusKey, and other SIS/HRIS that can export data can be
translated into the Canvas CSV format or sent directly to the
Canvas SIS API.
Study.net
Digital learning content
11 September 2014
Instructure, Inc.
49
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Content/Tool/Service
Description
Tegrity, Panopto,
Echo360
Lecture capture
Third-party content and
legacy LMS
course/content import
Cengage ePack, Canvas Common Cartridge, McGraw Hill
Common Cartridge, Pearson ePack, WW Norton packages,
SCORM 1.2 and higher packages (content only) , Blackboard 69x, WebCT CE 6+, WebCT Vista 1-4, ANGEL, Moodle, and
Desire2Learn
TurningPoint, i>clicker
Classroom response system (clicker)
Turnitin
Plagiarism checking service
BigBlueButton*, Wimba,
Blackboard Collaborate,
WizIQ
Web conferencing and collaboration tools
Additional third-party
systems, applications, and
services*
Flickr, Delicious, Diigo, Skype, Amazon, Google Calendar,
RSS/Atom Feeds, iCal, YouTube, and mobile apps
One way that Canvas ensures that we are in synch with third-party integrations is by establishing
partnerships. Our Partnership Program establishes strategic relationships with third-party vendors,
education content publishers, and service providers. The website for the Partnership Program is
http://www.instructure.com/partners.
•
Premier Partners include Pearson, Cengage Learning, McGraw-Hill, and Wiley.
•
Certified Partners include: EQUELLA, Respondus, Panopto, Turning Technologies, WizIQ,
i>clicker, Study.Net, SoftChalk, ShareStream, W.W. Norton & Co., CourseSmart, Macmillan,
eXplorance, AspirEDU, Adobe, Ensemble Video, EvaluationKIT, and more.
•
Community Partners include NOOK Study, Blindside, Scribd, Turnitin, and Crocodoc.
11 September 2014
Instructure, Inc.
50
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
ww) The LMS service shall allow assessment feedback with multimedia support for teacher video
responses to an individual student.
The SpeedGrader enables instructors to attach text/audio/video feedback as well as files to the
coursework. Users can attach video or audio commentary without even leaving the SpeedGrader
screen. A screen pops up and allows the user to record quickly and easily and then the video preview
is automatically inserted in the comments. Instructors can provide feedback to students, including
marked-up copies of student coursework submission, without having to navigate away from the
document viewer. The SpeedGrader also includes a speech recognition feature to convert recorded
audio comments to text. Instructors can also annotate, highlight, and comment on submissions as
shown in Figure 22. SpeedGrader is available to grade any assignment, test, or discussion.
11 September 2014
Instructure, Inc.
51
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Figure 22 Annotating, highlighting, and commenting on submissions.
A unique feature of Speedgrader is that students can respond to feedback with text/audio/video. By
allowing for response, instructors can modify feedback to include follow-up questions to students or
suggestions for improvement. Students can them respond to clarify instructor concerns or ask their
own follow up questions. An assignment is no longer merely a document submitted and then
forgotten, the ability for student response helps documents and learning objects continue to develop
and change. Ideally, the student will respond to the feedback and continue to develop a deeper
understanding of the assignment, possibly revising to improve. Allowing dialogue helps change
feedback from general comments to an opportunity for continued learning and improvement.
xx) Vendor shall describe in detail their assessment functionality including accommodations and
security.
Formative and Summative Assessments
Canvas provides tools to support your needs for both formative and summative assessments, as
listed and described in Table 5 and Table 6.
Table 5 Canvas Tools for Formative Assessment
Tool
11 September 2014
Application
Instructure, Inc.
52
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Tool
Application
Assignments
Supports assessment using SpeedGrader's rubric, annotation tools, and
discussion provide corrective feedback. Supports multiple assignment
submissions and revisions. Supports linking one assignment to another. Supports
URL submission for blog posts and other coursework. Provides peer review.
Surveys
Collects direct feedback from students (self-reports). Evaluate course design,
content, and delivery.
Discussions
Supports reflective topics requiring students to metacogitate, understand and
accept critical feedback from peers, and form opinions through diverse
perspectives.
Quizzes
Supports multiple attempts, automated feedback, and module release based on
prerequisites and completion criteria. Assessment using SpeedGrader's rubric,
annotation tools, and discussion provide corrective feedback.
ePortfolio
Provides for comments on any page or artifact that can direct students to think
critically on their work and adjust future learning.
Grades
Provides “Message students who...” (messaging based on gradebook criterion)
and feedback directly on scores.
Analytics
Provides student analytics dashboard reflecting past behavior (e.g. activity in the
site, interactions, lateness) and suggesting relationships between those measures
and current grades.
Table 6 Canvas Tools for Summative Assessment
Tool
Application
Assignments
Supports rubrics and outcome alignment. Supports Turnitin integration. Supports
URL submission for ePortfolio, web sites, wikis, and other coursework.
Quizzes
Provides automated scoring, objective question types, multimedia essays,
outcome alignment of question banks. Preserves academic integrity with
randomization, IP filters, and passcode for proctoring. Supports Respondus
LockDown Browser integration.
ePortfolio
Provides showcasing of students’ reflections, coursework, and mastery over time.
Supports rubric- and outcome-based assessment.
Attendance
Provides objective assessment of in-seat time.
Grades
Provides calculations of final score based on weighted categories or raw scores.
11 September 2014
Instructure, Inc.
53
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Tool
Discussions
Application
Enables students to demonstrate their ability to critically think through a topic,
communicate, and engage with others. Supports rubric- and outcome-based
assessment using SpeedGrader.
Canvas Quizzes is the most commonly used assessment tool in Canvas. Canvas Quizzes include the
following features and functions:
•
Support for objective and subjective assessment types
•
Support for formative and summative assessments
•
Associated grading rubrics
•
Support for IMS Question & Test Interoperability (QTI) integrations
•
Assignable time limits
•
Access codes to authorize access to the survey/quiz for proctoring
•
Lock until and lock after dates
•
Adaptive release for pre-test and post-test
•
Answer shuffling
•
Allowing multiple attempts
•
Definable comments for each answer selection
•
Display the correct answer
•
Add extra credit
•
Auto-grading
•
Import assessments from Respondus and other third party tools and publishers
•
Addition of rich media in the assessment via the Rich Content Editor
•
Comments box where students can participate in self-assessment.
The Quizzes tool uses the Rich Content Editor, a WYSIWYG editor that enables users to create text
and rich content for test questions. The Rich Content Editor provides the embedding of and linking to
multimedia, video, audio, URLs, files, and other digital resources in course content, coursework, and
communications. The Editor provides an HTML view, an integrated equation editor, the ability to
integrate with external content repositories and resources, and the ability to record and embed
audio/video in content. The Quizzes tool interface is shown in Figure 23.
11 September 2014
Instructure, Inc.
54
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Figure 23 Quizzes tool interface.
The Quizzes tool provides the following question types: Multiple choice, True/False, Fill in the blank,
Fill in multiple blanks, Multiple answers, Multiple dropdowns, Matching, Numerical answer, Formula
question, Essay question, File upload question, and Text (no question).
Figure 24 shows the Quizzes interface for creating a multiple answer question and the student’s view
of the question when taking the quiz. Feedback is entered in the colored “balloons:” green for correct
answers, red for incorrect answers, and blue for general feedback.
Figure 24 Quizzes tool: interactive scoring and feedback.
11 September 2014
Instructure, Inc.
55
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Like other types of Canvas course content, quizzes can be used as a template to quickly create
additional quizzes. Practice assignments and quizzes that have proven effective for students, for
example, can be copied and used to create additional practice assignments and quizzes by changing
the content or links to resources in the Files repository or external content repositories.
Accommodations
The Quizzes tool enables instructors to set the availability date/times and number of attempts for
assessments for all students. The Moderate Quiz function then enables instructors to adjust the time
and number of attempts for individual students. Quizzes that allow multiple attempts can also specify
whether to keep the highest or keep the latest score.
Canvas Quizzes support the ability to grant special access for a specific learner and groups of
learners including extended due dates for assignments, and extended availability, time limits, and/or
number of attempts on quizzes. The Quizzes tool provides moderation features including
accommodating individual students who require more time or multiple attempts for assessments as
shown in Figure 25. The Moderate Quiz interface displays:
1. Student name
2. Number of times the student has already attempted to take this quiz
3. Time it took for the student to complete the quiz; the running time will display for students who
are currently taking the quiz (counting down for timed quizzes and counting up for non-timed
quizzes)
4. Number of remaining attempts, if any
5. Student's quiz score
To refresh the page and make sure all statistics are current, click the refresh icon [6]. Clicking on the
pencil icon brings up an edit page that enables the instructor to give one or more selected students
extra attempts on an assessment and extra time on attempts.
Figure 25 Moderate Quiz interface.
11 September 2014
Instructure, Inc.
56
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Security
The Quizzes tool provides exam security by optionally requiring an access code and/or restricting
access via a specified IP address filter. Canvas also supports integration with the Respondus
LockDown Browser to prevent students from copying and pasting from other URLs, accessing other
applications, or traveling to other websites during an assessment.
Canvas enables instructors to selectively release course content and activities based on criteria that
controls when users will be able to view and access them, as shown in Figure 26. Within a course,
activities such as quizzes and assignments can be selectively released based on specified class
section and “Available From” and/or “Until” dates..
Figure 26 Selective release of course coursework/content.
Question Banks
Creating ad-hoc, automatically graded quizzes in Canvas is extremely quick especially with Question
Banks. When a quiz is linked to a question bank, teachers can choose from question banks that they
have built in other courses. Teachers will also see account- and sub-account-level Question Banks,
making it easy for teachers in the same department or program to share resources. When an
assessment is linked to a Question Bank in a Question Group, Canvas will use questions from that
Question Bank and reference as many questions as indicated when the Question Group was set up,
as shown Figure 27.
Figure 27. Create a Question Group
11 September 2014
Instructure, Inc.
57
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Canvas will reference the chosen bank of questions [1] as each student takes the quiz. Each student
will get a random number of questions pulled from the bank. These questions will not be in sequential
order and will be random each time the quiz is taken or previewed.
Instructors can choose from Question Banks that they have built in other courses or create new
Question Banks. Teachers will also see account- and sub-account-level Question Banks, making it
easy for instructors to share institution-, department-, program-, and course-level assessment
resources. It would be simple to create Question Banks based on the Standard Course of Study. By
having Question Banks that link to the Standard Course of Study, you could ensure that all schools
are asking questions that assess the standards while making it simple to collect data on those
standards.
Quiz Statistics
The Quiz Statistics feature provides data about Canvas quizzes so that faculty and administrators can
view student performance and evaluate the effectiveness and validity of individual questions and the
quiz as a whole. In addition, test results can be downloaded in CSV format for subsequent import into
an analysis tool. Quiz Statistics show:
•
Class distribution of each question
•
Consistently unanswered questions
•
High ratio of wrong answers
•
Mean and standard deviation
•
Time to take the exam
•
Graphical representations of all student responses
Statistics for the selected quiz are accessed by clicking the Quiz Statistics button in the right-hand
sidebar of the Quizzes interface, as shown in Figure 28. Each row represents an individual quiz
question. The text of the question is given in the first column and the text of each answer and the
graphical representation of student responses are given in individual columns to the right. The correct
answer is indicated by the green bar.
When the mouse point hovers over an answer bar, the percentage and number of attempts for that
answer are displayed.
11 September 2014
Instructure, Inc.
58
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Figure 28 Canvas Quizzes: Quiz Statistics Redundancy and Failover
By default, the Quiz Statistics feature shows statistics for the students’ latest attempt of taking the
quiz. Clicking the Count All Attempts button in the right-hand sidebar will display the collective
statistics for all attempts for all students. The average time is updated to reflect the average time of all
attempts to take the quiz and each of the question rows are updated accordingly. Note that the Count
All Attempts button is replaced by the Count Only Each Latest Attempt button so that you can toggle
back to the previous view.
Canvas Quizzes provide item analysis of each quiz, including response chosen frequency, number of
students who choose answers for each question.
yy) The LMS service shall have electronic messaging with multimedia support.
Canvas Conversations and Inbox provide an intuitive course and system messaging service, as
shown in Figure 29. Canvas allows you to attach previously recorded multimedia files or record new
multimedia files in the message tool. As with all messaging in Canvas, Conversation messages are
routed to the Activity Streams of participants’ dashboards as well as to the communication channels
as specified in individual users’ notification preferences—as messages to their external email,
Facebook, Twitter, and/or LinkedIn accounts or as SMS texts to their cell phones. By routing
messages to students’, teachers’, and parents’ preferred delivery method, you can ensure that
messages are actually being received and read.
11 September 2014
Instructure, Inc.
59
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Figure 29 Canvas Conversations interface.
zz) The LMS service shall have support for webinar and instant messaging tools (vendor provided or
third party).
Canvas provides a synchronous chat tool that allows course members to type in real-time. In
addition, Canvas integrates with several third-party synchronous communication tools such as
Cranium Cafe, Hoot.me, Scribbler and VoiceThread.
aaa) The LMS service shall have discussion forums with multimedia attachment support on a per
class or course basis.
Canvas Discussions provide asynchronous (and near-synchronous) threaded public discussions,
subject posting, and replies. Canvas Discussions utilize the Rich Content Editor, which makes it easy
to incorporate audio, video, and web links. Discussions support multimedia attachments including
audio and video posts as shown in Figure 30.
11 September 2014
Instructure, Inc.
60
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Figure 30 Canvas Discussions
Canvas threaded discussions are designed for easy navigation, as shown in Figure 31. Color-coding
identifies replies that have been read and replies that are unread. A gear icon is provided that
presents options to the user to either “Go to Parent” to see the original post, or to edit or delete the
current post, or reply. Clicking on the responder’s name will collapse the response to make the
discussion easier to view and manage. Canvas also makes it easy to see when a student replies to
another student’s post, and presents clearly how many unread, and how many total replies are in the
thread.
11 September 2014
Instructure, Inc.
61
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Figure 31 Canvas Discussions interface.
11 September 2014
Instructure, Inc.
62
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Creating a discussion is quick and easy, as shown in Figure 32.To turn a focused discussion into a
threaded discussion, the instructor simply checks the “This is a Threaded Discussion” checkbox. The
instructor also identifies the discussion as a graded assignment through a simple checkbox function.
Figure 32 Discussion Creation Tool
Instructors can determine if students can create new posts, edit or delete posts, or attach files to the
post, as shown in Figure 33.
11 September 2014
Instructure, Inc.
63
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Figure 33 Discussion Settings
bbb) The LMS service shall have role impersonation for administrators and teachers.
In addition to the “Student View” feature, Canvas also provides a “Become other users” permission
and a corresponding Masquerade function that enables administrators and IT support managers and
staff to proxy as other users so that they can provide training and troubleshooting assistance. To
remind authorized users about the proper use of the Masquerade function, Canvas displays the
confirmation dialog shown in Figure 34.
11 September 2014
Instructure, Inc.
64
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Figure 34 Masquerading as a user.
ccc) The LMS service shall have customizable user notifications, including:
i.
User selectable notification method: email, SMS or IM.
While Canvas itself encourages and facilitates communication throughout the system, Canvas puts
the power of communication within the hands of the individual user. This encourages users to engage
with courses using the tools they are most comfortable with, and best fit their lifestyles. Notifications
let users individualize the way Canvas informs them of news and activity within their courses using
email, text (SMS), or popular third-party social media tools like Twitter or Facebook. Canvas includes
configurable Notifications, which help users receive notifications through various channels, including

The Canvas dashboard communication stream

Conversations Inbox, Discussions, Assignment feedback, and Grades

External email

Mobile phone text messaging

Social network tools like Twitter
Users can also determine how they get notifications depending on the category (graded assignment,
announcement, etc). Users can also set the frequently of notifications (ASAP, daily, weekly) as
shown in Figure 35.
11 September 2014
Instructure, Inc.
65
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Figure 35 Students Can Opt Into Receiving Grades Notifications in their Account Settings
ii.
Daily summary emails with selected statistics.
As mentioned above in ccc i., Canvas offers a notification tool that allows users to determine how and
when to receive notifications (see Figure 35). Canvas provides the following notifications: Due Date,
Grading Policies, Course Content, Files, Announcement, Grading, Invitation, Submission Comment,
Discussion, Discussion Post, Added to Conversation, Conversation Message, Scheduling, Student
Appointment Signups, Appointment Signups, Appointment Cancelations, Appointment Availability,
Calendar, Groups, and Administrative Notifications.
Canvas provides a robust open API that can be a method for developing custom scheduled daily
summary emails for other types of data and reporting including general usage statistics. We would be
happy to discuss this requirement with you in more detail in order to find a solution that will fit your
needs.
11 September 2014
Instructure, Inc.
66
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
iii.
Personalization with form fields – e.g. Dear %USER%
Personalization with form fields is not supported in Canvas. However, as a result of Canvas’ open
architecture and robust support for 3rd party applications, personalized user notifications could be
accomplished through customization or use of a 3rd party solution.
ddd) The LMS service shall include online journals in a blog or wiki format with forum support.
Students can use Canvas Pages to create rich content wiki pages within Canvas and can include links
to personal web pages, blogs, and registered services such as Facebook and LinkedIn. Students can
also use public ePortfolios to create personal web pages to display and comment on their coursework.
Canvas also supports integrations with popular blogging tools including WordPress, Status.net, and
Campus Pack.
The Canvas ePortfolio tool lets students and instructors create online portfolios. The ePortfolio tool
would provide an excellent format for online journals. As a showcase of a student’s learning
experiences that aggregate both new and past coursework, ePortfolios can be publicly shared and
tied into course, program, and/or institutional assessments based on Learning Outcomes. ePortfolios
can be organized into Sections and Pages. Page can contain text, multimedia, and/or links to files and
coursework submissions. ePortfolio Pages also allow for public and private commenting, as well as
forum commenting. In addition, Canvas supports integrations with Campus Pack, Mahara, Pathbrite,
PebblePad, and Taskstream. These third-party ePortfolio tools are LTI-compliant tools available in the
Canvas App Center. The ePortfolio interface is shown in Figure 36.
11 September 2014
Instructure, Inc.
67
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Figure 36 ePortfolio tool.
Figure 37 and Figure 38 show examples of University of Washington’s students’ ePortfolios. These
ePortfolios are publicly available
https://canvas.uw.edu/eportfolios/12907/Home/IntroductionLets_go_diving and
https://canvas.uw.edu/eportfolios/12029 respectively.
11 September 2014
Instructure, Inc.
68
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Figure 37 Canvas ePortfolio Example #1
Figure 38 Canvas ePortfolio Example #2
eee) The LMS service shall include ability for teachers to create content pages.
The Canvas content creation tools—Pages, Assignments, Quizzes, Announcements, Discussions—all
use the Rich Content Editor, a WYSIWYG editor that enables users to create formatted text and rich
content for course content and coursework. As shown in Figure 39the Rich Content Editor provides
the embedding of and linking to multimedia, video, audio, URLs, files, and other digital resources in
course content, coursework, and communications. Files, links, and images can be dragged and
dropped from the Content Panel into the Rich Content Editor for the creation of course content and
11 September 2014
Instructure, Inc.
69
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
coursework. The Editor also supports integration with external content repositories and resources
such as EQUELLA, YouTube, Flickr, and IMS LTI-compliant tools and services.
The HTML view of the Editor enables advanced users to directly enter HTML code for scientific,
music, and other specialized content.
The Editor also includes an integrated Equation editor that enables users to build mathematical
equations and chemical formulas using graphical tools or by typing/pasting the equation in LaTeX
format directly into the Editor. Equations and formulas are displayed as fully typeset images. The
alternative text of the image is set to the LaTeX text of the equation for assistive technologies like
screen readers.
Figure 39. Rich Content Editor Interface
fff) The LMS service shall include storage for project based learning (e.g. ePortfolio) including:
i.
Students storing works for specific courses than can be exported later.
The ePortfolio provides a showcase of a student’s learning experiences that aggregate both new and
past coursework. Pages can contain text, multimedia, and/or links to files and coursework
submissions. The ePortfolio makes it simple to bring in coursework from prior courses. Students can
even export coursework as a zipfile.
11 September 2014
Instructure, Inc.
70
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
ii.
Students sharing content with others, including college admissions.
Students can share their ePortfolio publicly by sharing the link. EPortfolios also allow for public or
private commenting. Students can also export ePortfolios as a zipfile and save it that way.
ggg) The LMS service shall allow numeric or alphanumeric grades for assessments.
Canvas supports both numeric and alphanumeric grades. The Gradebook helps instructors easily
input and distribute grades for students as shown in Figure 40. Grades for each assignment or
assessment can be calculated as points, percentages, complete or incomplete, pass or fail, GPA
scale, and letter grades, and assignments can be organized into groups for weighting as well.
Figure 40 Teacher View of Gradebook
hhh) The LMS service shall allow per item numerical weighting for scoring assessments.
Canvas allows instructors to use numerical weighting for scoring assessments. Instructors can
determine the point value of each individual item to ensure that each question is weighted
appropriately (e.g. 1 essay question worth 5pts, 5 multiple choice worth 1pt each means essay = 50%
of score, multiple choice = 10% of score each). Instructors can also use weighting in regards to final
grades, as shown in Figure 41.
11 September 2014
Instructure, Inc.
71
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Figure 41 Weighting the Final Grade
iii) The LMS service shall have multiple language support for assessment creation (e.g. Spanish or
English).
Canvas allows teachers or administrators to designate the language for a Canvas course or account,
resulting in the translation of all Canvas components.
Supported languages are listed below, however users can request new languages through Transifex,
a crowd-sourced project. Crowd-sourced languages are translated and reviewed on a volunteerbasis.
Languages supported by Canvas:
1. English (also UK & Australian localizations)
2. Arabic
3. Chinese (Simplified)
4. Chinese (Traditional - is in progress)
5. Dutch
6. French
7. German
8. Japanese
9. Norwegian Bokmal
10. Polish
11. Portuguese: Spain
11 September 2014
Instructure, Inc.
72
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
12. Portuguese: Brazil
13. Spanish
14. Russian
Crowd-sourced languages:
1. Korean
2. Farsi (Persian: Iran)
3. Turkish
jjj) The LMS service shall provide for teacher progress monitoring.
In regards to teacher progress in a professional development setting, the Professional Development
(PD) trainer could use all of the same tools teachers use to monitor their students' progress. In
addition, principals or others with a vested interest could check progress of their teachers PD program
using the Observer account, "parent portal" functionality and/or custom Canvas roles restricted to
view teachers and courses by building, grade or subject.
In regards to alerts as a way of checking for instructor inactivity, Canvas does offer the Alerts tool.
The Alerts Tool is specifically an Admin function of Canvas, allowing administrators to set up
automatic notification to users based on teacher inactivity, as shown in Figure 42.
Figure 42 Alerts Interface
11 September 2014
Instructure, Inc.
73
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
kkk) The LMS service shall provide grading reports.
In regards to parents having access to grades, Canvas provides a Parent Co-enrollment feature,
which enables parents to have an observer role for the courses in which their children are enrolled.
The Parent Co-enrollment feature enables parents to log into Canvas and see all of the course
material and activities in their children’s courses. Parents can see the text, audio, and/or video
feedback that teachers attach to their children’s assignments and quizzes. They can also see
discussions, conversations, and other communications that their children have participated in; grading
rubrics and the associated learning outcomes aligned to those rubrics so that they know what skills
that the course material or activity was designed to teach; and their child’s scores for those learning
outcomes to track their child’s progress for specific skills and competencies.
In regards to students receiving notification and reports, students can determine how and when they
receive notifications when an assignment is graded (ASAP, daily report, or weekly report).
Canvas also provides a standard student grade report, standard teacher gradebook and administrator
Grades report (admin > Settings > Reports > Grade Export).
lll) The LMS service shall allow students to view grades and assessment performance and see
feedback.
Canvas allows students to view grades, as well as feedback. Students are notified when they receive
a new grade or feedback. Feedback is an essential component of learning and Canvas works hard to
ensure that feedback is easy to give and to receive. Instructors can provide feedback to students,
including marked-up copies of student coursework submission, without having to navigate away from
the document viewer, as shown in Figure 43. The SpeedGrader enables instructors to attach
text/audio/video feedback as well as files to the coursework. Students can respond to feedback with
text/audio/video. This ability to respond initiates a dialogue between instructors and students creating
opportunities for deeper understanding.
11 September 2014
Instructure, Inc.
74
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Figure 43 Annotating, highlighting, and commenting on submissions.
Students can easily view their grades on the Gradebook, which provides comprehensive information
about grades and links to feedback, as shown in Figure 44. Grades are sorted chronologically by
assignment due date, followed by assignments with no due dates.
11 September 2014
Instructure, Inc.
75
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Figure 44 Student Gradebook View
Students can view the name of the assignment [1], the assignment due date [2], the score they
earned [3], the total point value of the assignment [4], and icons for any assignment details [5].
Students may also see an icon in the score column [6] indicating the type of assignment they
submitted. Once the instructor has graded the assignment, a score will replace the icon. Students can
click any score field (including ungraded assignments) and approximate their grade using what-if
scores.
11 September 2014
Instructure, Inc.
76
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Assignment groups will always display as a percentage. For percentages, students can hover over the
percentage to see a breakdown in the points they have earned vs. the total points possible.
mmm) The LMS service shall provide per-standard reports for teachers and students.
Canvas Learning Outcomes enables the administration and faculty to track students’ progress as
measured by pedagogical goals or desired outcomes.
Outcomes are used to:
•
Focus students' attention on the most important skills and activities in a course
•
Align Quizzes and Assignments to different kinds of mastery
•
Run reports at the account-level about student artifacts of learning mastery
•
Align accreditation or other standards to programs of study, courses, or student assessments
Canvas Learning Outcomes would be an excellent tool to ensure that the Standard Course of Study in
integrated into curriculum on every level from assignments to assessments to portfolios, as discussed
in Section 1 Proposal Summary. The Standard Course of Study can be imported into Canvas courses
as Outcomes. Outcomes can be nested by dragging and dropping outcomes to reflect organizational
structure at the account, sub-account, and course levels.
Learning Outcomes can be tied into coursework allowing administrators to run reports based on
individual outcomes: learning outcomes rollup report at the admin level (admin > Outcomes > browse
to outcome > click Outcome title) and Outcome Results & Student Competency reports (admin >
Settings > Reports).
Another tool that would help with assessing standards is the Mastery Gradebook, which offers teacher
and student reports. The Learning Mastery Gradebook helps faculty and administrators assess the
outcomes that are being used in Canvas courses. As a major upgrade to the course Gradebook, the
Learning Mastery Gradebook provides an overview of student learning based on standards rather
than grades. Instructors can also use the gradebook for feedback about curriculum and teaching
methods.
The Learning Mastery Gradebook interface is shown in Figure 45. All scores are color-coded to show
outcomes and the level attained by each student: mastery (green), near mastery (yellow), and
remedial (red). Score levels are calculated based on half of the outcome mastery threshold. You can
toggle the boxes in the sidebar to filter scores for a specific level.
11 September 2014
Instructure, Inc.
77
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Figure 45 Learning Mastery Gradebook Interface
The Learning Mastery Gradebook also allows administrators to view learning outcome mastery
broken down by percentage, as shown in Figure 46. The mastery level is broken down into three
levels: exceeds expectations, meets expectations, and does not meet expectations.
Figure 46 Outcome Breakdown Percentages
11 September 2014
Instructure, Inc.
78
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
The Learning Mastery Gradebook also allows users to filter the Gradebook by mastery level: mastery,
near mastery, or remedial (as shown in Figure 47).
Figure 47 Filtering the Learning Mastery Gradebook
Outcome statistics for the entire course or a course section can be viewed according to course
average, course median, or course mode. Instructors and administrators can select the preferred
statistic from the drop-down menu next to the score indicator for each outcome, as shown in Figure
48. These course statistics also display color-coded level results based on the outcome results.
Figure 48 Viewing Outcome Statistics by Course Average, Median, or Mode
The Learning Mastery Individual View allows instructors to assess one student and one outcome at a
time, as shown in Figure 49. Complete with all features in the Learning Mastery Gradebook, this
gradebook view is fully accessible to screen readers.
11 September 2014
Instructure, Inc.
79
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Figure 49 Mastery Gradebook: Individual View
Individual View contains all the global settings found in the Learning Mastery Gradebook. Instructors
can sort by section and hide student names.
In the Learning Mastery Gradebook, instructors can access Individual View by clicking the Switch to
Individual View link. Unlike the Learning Mastery Gradebook, Individual View does not take up the
entire Canvas window and shows the Course Navigation menu. Like all Gradebook tabs, Individual
View is persistent and will always display when it is the last view last accessed by an instructor. To
leave Individual View, click the Switch to Grid View link.
In regards to reports on teachers meeting training standards, administrators can view teacher
proficiency on PD learning outcomes. Canvas learning outcomes functionality can be used for PD just
as it would be for classroom classes. Administrators can also see a roll-up of how each teacher’s
group of students performs on standards (to try to help gauge a teacher's effectiveness at teaching a
range of standards). Learning outcomes performance data can exported via admin > Settings >
Reports or via the API. The data can be grouped by instructor or class as a method of roll-up.
The open API also simplifies pulling learning outcomes data as well as a many other types of data.
nnn) The LMS service shall have a plagiarism detection tool.
Canvas does not have a native plagiarism detection tool; however, Canvas integrates with TurnItIn.
ooo) The LMS service shall have standards aligned assessments with mastery by standards reports.
Assessments created to test student knowledge or to require students to demonstrate a specific skill
resulting from a learning activity can be aligned to Outcomes using Rubrics, which can also be used
for grading. Grading student work automatically collects and compiles data on student progress for
11 September 2014
Instructure, Inc.
80
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
the Outcomes. The data is available for reporting to support teaching improvement, identify at-risk
students, and support the accreditation process. This unified, streamlined approach dramatically
reduces the amount of work required to implement Outcomes through the intelligent reuse of
assessment workflows in the grading process.
Aligning Outcomes to a bank of questions can provide a more accurate measurement than a single
question due to the possible variety of questions and what is being measured. When applicable, it is
possible to align multiple Outcomes to a question bank by aligning individual outcomes.
In order to help instructors have an accurate view of study progress on standards, Canvas offers a
Learning Mastery Gradebook (for further information see mmm) that gives a view of not only grades
but also what specific standards students are struggling with.
ppp) The LMS service grade book shall have drag and drop assignment setup.
Columns are automatically created in the gradebook when an assignment is setup. The teacher can
move the Total column to the front of the Gradebook to quickly see an overview of student progress in
your course.
qqq) The LMS service shall support per-user role styles.
The Canvas LMS Administrator account includes a Settings tool that helps Administrators manage
and customize accounts, courses, user-level settings, features, and functions, including:

Courses

Users

Statistics

Permissions

Outcomes

Rubrics

Grading Schemes

Question Banks

Sub-Accounts

Faculty Journal

Terms

Authentication

SIS Import

Settings
The Settings tool enables administrators to specify the account name, the account domain, the course
file quota, the user file quota, default language, default time zone, self-enrollment course settings,
quiz IP address filters, custom help links, enabled integrations, enabled web services, course creation
permissions, and more.
Access to Canvas information, features, and functionality is controlled by user authentication, user
accounts, and user role permissions. The default roles are student, TA, teacher, design, and
observer (parent). Canvas provides a fine level of granularity of user-role based access control with
over 70 account- and course-level permissions including “Manage (create / edit / delete) course
sections,” “Change course state,” “Manage (add / edit / delete) course files,” and other permissions
that control access to and the ability to change course-level content and settings
Account Administrators are “super-users” with all permissions granted at the account and course
levels. Administrators can be restricted to sub-accounts with full administrative permissions limited to
11 September 2014
Instructure, Inc.
81
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
the sub-account and the constituent courses. The “Manage permissions” permission allows that user
role to enable and disable (and optionally lock the setting) the permissions of other user roles as
shown in Figure 50.
Figure 50 User role permissions interface of Canvas Administrator’s dashboard.
Administrators can determine what the permissions for each role look like, thus creating a role-style.
Then whenever a new user is assigned a role, the user is automatically given those same rights and
permissions. As noted above, administrators can also create custom permissions for individual users.
Also, users can have different roles depending on the situation. A teacher may take on a student role
when working on professional development requirements. If a TA is enrolled as a student in another
course, the student will only have student permissions in the course they are taking.
rrr) The LMS service shall meet current accessibility standards, including Section 508, W3C WCAG
2.0 and N.C.G.S. § 168A-7.
Canvas adheres to accessibility guidelines of Section 508 of the Rehabilitation Act as documented in
our Voluntary Product Accessibility Template (VPAT), which is publicly available at
http://www.instructure.com/canvas-vpat.
By using W3C's Web Accessibility Initiative (WAI) Web Content Accessibility Guidelines (WCAG) 2.0
AA, Accessible Rich Internet Applications (ARIA), and Authoring Tool Accessibility Guidelines
(ATAG), Instructure ensures that even the most interactive, dynamic widgets in Canvas are easy to
11 September 2014
Instructure, Inc.
82
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
use with assistive technology such as JAWS (Job Access With Speech) and NonVisual Desktop
Access (NVDA).
Instructure continually strives to make Canvas a great experience for all users by ensuring the
accessibility of Canvas. Canvas avoids problematic content, such as Flash content, and even
converts math equations to MathML automatically. Utilizing the best Web 2.0 technologies and latest
standards, Canvas was developed with modern, semantic markup and accessibility techniques. Some
of the measures that Instructure takes to ensure the highest level of compliance are
•
Client branding assistance to maintain Canvas’s compliance with contrast ratios, styles, and
color schemes
•
“Alt” tags in system images
•
Automatic tags for users’ images in content pane for creating content
•
Prompt for “alt text” when embedding external images
•
Rich Content Editor only provides styles when formatting text
•
Moderation of quizzes for individuals requiring more time or multiple attempts
In regards to N.C.G.S. § 168A-7, Canvas does everything in its power to ensure that it is in compliance
with accessibility standards. We realize that accessibility is essential to a student’s success, so we
make accessibility a top priority. Please take the time to look over Voluntary Product Accessibility
Template (VPAT) http://www.instructure.com/canvas-vpat.
sss) Vendor shall describe their view of the most significant risks they perceive in this project, and
how their proposed solution is best suited to mitigate those risks.
The Implementation Manager and Client Services teams work closely with you to identify all risk
factors and evaluate their potential impact on the implementation plan and schedule. Risk factors that
warrant further evaluation will undergo risk qualification and mitigating or remedial action items will be
defined and assigned. Risk qualification addresses the following risk register elements:
•
Description of the risk factor or event.
•
Schedule Impact. The number of hours, days, week, or months that a risk factor could impact
the schedule.
•
Scope Impact. The impact the risk will have on the implementation timeline or contract.
•
Cost Impact. The impact the risk event, if it occurs is likely to have on the project budget or
contract.
At any time during the implementation project, any risk factors or events that your organization
identifies or anticipates should be brought immediately to the attention of the Implementation Manager
or the Client Services team. Figure 25 lists the inherent implementation risks and the associated
mitigation strategies and actions that Instructure takes to ensure a smooth and successful
implementation.
11 September 2014
Instructure, Inc.
83
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Table 7 Implementation Risks and Mitigation
Risk
Mitigation Strategy
Content not properly
migrated
Instructure extensively tests all content migration scripts to
ensure full content portability. If unusual circumstances arise
that prevent full automated migration of content, manual
insertion of the content into the destination course may be
necessary in some cases.
SIS imports not
functioning properly
Instructure provides a test cluster environment for the client
institution to test all SIS import functions. The environment is
available for 60 days and additional time may be purchased if
required.
User authentication not
functioning properly
Instructure provides a test cluster environment for the client to
test user authentication integrations such as LDAP, SAML,
and CAS. The environment is available for 60 days and
additional time may be purchased if required.
System performance
and availability
concerns
Instructure continually monitors system performance and
availability. In the unlikely event that the system performance
degrades or the system becomes unavailable, Instructure will
initiate fail-over to redundant resources and the Instructure
Support and Engineering teams will analyze and resolve the
cause.
Canvas works hard to ensure that our clients are satisfied with the product. We will work hard to
ensure that Canvas fits your institution and its needs. Instructure believes that Canvas should
empower teaching and learning without burdening teachers and students. Technology is a tool of
education, and if we do our work right Canvas, first, stays out of the way, and, second, encourages
teachers and learners to innovate and improve their practice. We are here to support you and the best
way we can do that is by providing you with a product that works well so you can focus on what is
most important, your students’ learning.
Canvas will be your partner as you complete the implementation process. We are with you every step
of the way to ensure that everything goes smoothly. Or you can read what one of our first clients said,
“If we had to make the decision again, without a doubt, it would be Canvas." - Scott Allen, Learning
Systems Admin at UEN after going through the migration process of over 12,000 courses for 110,000 FTE
11 September 2014
Instructure, Inc.
84
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
ttt) Vendor shall describe their suggested metrics for evaluating satisfactory LMS Service performance
levels. Which test metrics should be used, and what values would indicate success?
Canvas feels that satisfactory LMS service performance level standards should be set high. Our job is
to ensure that you have access to the system. Your students, teachers, and employees need to have
a reliable system that is always available. For that reason, we continually monitor the availability and
performance of the Canvas service. Service levels are measured in percent of availability; the Master
Subscription Services Agreement guarantees 99.9% uptime.
uuu) Vendor shall describe their Project Team Organization and Staffing plan. The Vendor shall
designate key personnel to DPI with contact information before execution of the contract.
Melissa Gomez, Regional Director K-12
In the project role of Business Representative, Melissa will be the key contact during the business
agreement stage, which formalizes the relationship between Instructure and the NCDPI. Melissa will
remain closely involved during the implementation phase and will be the principal contact for inquiries
about Instructure’s Professional Services. Melissa’s experience in education ranges from designing,
implementing, and maintaining an LMS to providing Canvas demonstrations, customer service, and
implementation guidance to new users. Melissa earned her BA in Marketing, from Western Governors
University in Salt Lake City, Utah.
Buck Harrison, Manager of Implementation
Buck will be responsible for the execution and monitoring of the implementation plan and schedule.
Buck will be the primary point of contact for questions about implementation including technical, on
boarding, and integration issues. Buck has over 10 years experience in technical support and
implementations. He is classically trained in learning theory and pedagogy emphasizing in designbased research, blended learning, micro-credentials, open education resources, and online education.
Buck has a BS in Business Information Systems from DeVry University and an MS in Instructional
Psychology and Technology from Brigham Young University. He leads a team of implementation
consultants that share this same commitment to excellence in implementing Canvas to each and
every institution.
Ike Nelson, Director of Customer Success
Ike will assign and oversee the Customer Success Manager (CSM) who will be the key contact for
member contract over the term of the account. Ike will ensure timely and responsive access to
Instructure’s support services and other resources. Ike has over nine years of customer service
experience in the software industry. Ike received his bachelor’s degree in economics from the
University of Utah. Prior to joining Instructure, Ike worked at LANDesk as a Renewal Sales Associate,
Channel Program Manager, and Inside Sales Specialist. Ike also worked at Symantec/Altiris as a
Sales Operations Specialist.
Seth Johnson, Director of Support
11 September 2014
Instructure, Inc.
85
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Seth will oversee the on-going technical support. Seth has extensive experience in supervising and
managing customer care contact centers. Prior to joining Instructure, Seth worked as the Director of
Customer Care & Risk Management at eHarmony, was a Partner at thereNow, and was the Director
of Development at Spectrum Research, Evaluation, & Development (SpectrumRED). Seth earned his
Master of Science degree in instructional technology at Utah State University.
vvv) The Vendor shall provide a copy of their standard Service Level Agreement (SLA) or support
agreement and include notation of optional levels of service. The agreements should include, but not
be limited to, 99% uptime on a quarterly basis (no more than 2.19 hours total per quarter of
unscheduled downtime); maintenance windows as specified with downtime for maintenance/updates
coordinated in advance; availability objectives (including disaster recovery); procedures for reporting
incidents to the Vendor (including Vendor support contact information); incident severity classifications
and definitions, response times and resolution times, and escalations. The agreements shall include
provisions establishing the remedies, such as refunds or service credits, that NCDPI shall be entitled
to in the event that Vendor fails to meet the performance metrics established in the agreement.
Instructure guarantees 99.9% system availability and provides full support, rolling updates with no
downtime, backups, and data recovery.
Please see our Master Subscription Services Agreement (MSSA) in Appendix B.
www) The Vendor shall provide 24/7/365 support. This shall include system monitoring, responses to
unscheduled outages and service inquiries from the designated LMS service manager. The Vendor
shall provide a Level 3 response time of 24 hours and a Level 1 response time of 1 hour.
Instructure employs an industry-standard, traditional three-tier technical support methodology for
incident reporting, escalation, and resolution. Under Instructure’s Support Package, Tier I support is
provided by the institution’s LMS Administrator and Instructure’s Support team provides Tier II and
Tier III technical support. Instructure also offers optional Tier I Support that provides live 24/7/365
technical support for the institution’s faculty. Table 8 provides a description of Premium Support that
provides 24/7/365 support.
Table 8 Premium Support Package
Premium Support
Cost
20% of annual
subscription fee or $2,500
minimum
Tier I Support
Faculty Support
10% of annual
subscription fees or
$1,000 total minimum
$500 minimum
One-time setup fee
11 September 2014
Instructure, Inc.
86
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Tier I Support
Premium Support
Faculty Support
Online Canvas
Help Center
24/7/365
24/7/365
Email Support
(escalated tickets to Tier
II & III)
8-hour response time
8-hour response time
Toll-Free Phone Support
for LMS Admin
24/7/365
24/7/365
Authorized LMS Admin
Support Accounts 1
1
All Faculty
*For more than the allotted LMS Admins, an institution will be required to pay $500 per additional LMS Admin.
To provide NCDPI with the highest level of support, Instructure is proposing our Premium Support
package. Client institutions that subscribe to the Premium Support package and Tier I Support
consistently and enthusiastically report to us that they are extremely satisfied with the value, level of
service, and cost-effectiveness of these services. We would be happy to provide additional references
of client institutions that subscribe to the Premium and Tier I Support packages.
Tier I Support by Instructure’s Support team provides first-line help desk support to address and
resolve faculty issues such as logging into Canvas, questions about Canvas features and functions,
and resolving other operational problems.
Instructure Tier I Support requires the purchase of Premium Support as described in Table 8 as well
as the setup and per User costs shown in Table 9.
Table 9 Instructure Tier I Support Costs
Description
11 September 2014
Costs
One-time setup fee
$500
Per annual User subscription
10% of annual subscription
$1,000 per year minimum
Instructure, Inc.
87
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
The institution’s users can contact Instructure’s Tier I Support staff 24/7 through online ticket
submission, chat, e-mail, or phone. The institution’s LMS administrator(s) have access to all end-user
submitted tickets and monthly usage reports. Instructure’s Tier I Support can be made accessible
through the institution’s own branded support portal. Instructure Tier I Support requires the purchase
of Premium Support. Table 10 lists Tier I support service levels.
Table 10 Instructure Tier I Support Service Levels
Service
Service Level
First contact resolution
Greater than 75%
Call abandon rate
Less than 10%
Phone
80% of calls answered in 60 seconds or less
Online chat
80% of chat requests answered in 120 seconds or less
Online form – email & help
desk ticket response
80% of tickets or emails responded to in 60 minutes or
less
The three tier ticket escalation process begins with a support ticket. A reported incident opens a
support ticket in Zendesk, the help desk system used by Instructure’s Support team. Tickets are
automatically opened when the reporting method is the Help tool, the Canvas Help Center, or email.
Tickets are manually opened when reported by phone. Users can track the status of their support
tickets 24/7 through the Canvas Help Center.
Tier I
All support tickets are initially routed by Zendesk to Tier I support for resolution. Under Instructure’s
Basic, Advanced, and Premium Support package, Tier I support is provided by the local LMS
Administrator who is qualified through training and experience to troubleshoot and resolve the majority
of user-related incidents. Instructure does offer optional Tier I Support services. Typical incidents
resolved by Tier I support include access problems and general usage questions.
Under the Basic and optional Advanced Support Packages, the local LMS Administrator has access
to Instructure phone support Monday through Friday, 6am to 6pm Mountain Time. Under the optional
Premium Support package, the local LMS Administrator has access to Instructure phone support
24/7/365.
Tier II
If the local LMS Administrator cannot resolve the incident in the established time frame or if the LMS
Administrator determines the severity of the incident requires the attention of the Instructure Support
11 September 2014
Instructure, Inc.
88
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
technicians, the LMS Administrator escalates the incident and the associated support ticket is routed
by Zendesk to the Support team. Tier II support resolves medium-severity incidents such as
performance issues, unexpected system behaviors, administrative questions, and answering design
and integration questions.
Tier III
If Tier II support cannot resolve the incident in the established time frame or if the Instructure Support
team determines the severity of the incident requires the attention of the Instructure Engineering
team, the Instructure Support technicians escalate the incident to Tier III and the associated support
ticket is routed by Zendesk to the Instructure Engineering team. Tier III support resolves high-severity
incidents such as system failures, code-level related issues, and system bugs.
Please see Table 11 for average response and resolution times based on the urgency and importance
of tickets over the last 12 months. The release notes for the past 12 months are available at:
http://help.instructure.com/forums/337224-product-release-notes.
Table 11 Support Metrics
Metric
1
Value
Number of upgrades/updates/bug fixes in 12 months1
24
Average response time for urgent needs
26.71 minutes
Average response time for important, but not urgent needs
77 minutes
Average response time for other needs
106.18 minutes
Number of staff working on support/troubleshooting
30
Number of institutions each technical staff person supports
2.23
Average age for a trouble ticket before it is resolved
10.65 hours
Average number of tickets resolved in 24 hours
26%
Number of incidents escalated above Tier I support
7%
Average response time for escalated versus routine issues
14 minutes
Number of tickets resolved in 48 hours
55.82%
Number of all tickets resolved in 4 days or less
70.81%
Triweekly release schedule
11 September 2014
Instructure, Inc.
89
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
In addition to the more traditional technical support, the Canvas Help Center provides 24/7/52 webbased support and knowledgebase, accessed directly at http://help.instructure.com or by clicking the
Help button in the Canvas interface. The Canvas Help Center contains links to Canvas Guides, as well
as to video tutorials, FAQs, user-group specific help, discussion boards, release notes, access to
Canvas Communities sites including Google Groups, Facebook, Listserv, Open Source, and clientspecific communities.
Instructure continually monitors system performance and availability. In the unlikely event that system
performance degrades or the system becomes unavailable, Instructure initiates fail-over procedures to
redundant resources. Instructure’s Support and Engineering teams immediately work to analyze and
resolve any performance degradation as quickly as possible.
Instructure’s Engineering & Operations team maintains an Outage Log, a record of technical issues
with severity beyond the scope of Support technicians; such issues generally affect a significant
percentage of users. The Outage Log records data about each issue, including:

Date, time, and duration

Affected system(s)

Steps taken

Root cause
Significant events are reported to LMS administrators automatically (during and after the event) via
email; LMS administrators are added to the mailing list by their Account Manager.
xxx) The Vendor shall generate and distribute to the NCDPI monthly status reports including a
summary of customer support incidents reported by NCVPS, and, if applicable, LEAs and Charter
Schools, the total and incremental number of NCVPS, LEA and Charter School service descriptions
for the month, and availability and performance data. The Vendor shall conduct regular conference
calls with the NCDPI to review and discuss the performance of Vendor in meeting their responsibilities
for delivering the LMS service, notable outages and incidents, efforts to improve on identified
problems, and other issues affecting NCVPS, LEA, and Charter School use of the LMS service.
Canvas provides a monthly report of support tickets similar to what is described here; however, this is
a service done only for our Tier 1 Support customers. However, everyone has access to Zendesk and
can pull the data for themselves. We could definitely help you set up a View in Zendesk that would
make it simple to make your own reports that would satisfy this requirement.
Customer Service Managers hold regular status calls with clients to discuss performance, as well as
any other concerns that you might have.
11 September 2014
Instructure, Inc.
90
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
yyy) The Vendor shall conduct an annual NCVPS, and, if applicable, LEA and Charter School
customer satisfaction survey. The content of such survey shall be shared with the NCDPI in advance
with input from the NCDPI solicited prior to the distribution of the survey. The results of the customer
satisfaction survey shall be shared with the NCDPI.
We perform two sorts of satisfaction surveys three times a year. Product conducts an end-user survey
(students and teachers) monthly for users at schools that opt in. At any given school, one ninth of the
population is invited to participate each month, such that everybody has an opportunity once a
(school) year. The Administrator Survey is given three times a year. Our customer success director
has agreed to share the overall scores with you for just the Admins at NCDPI as well as our overall
customer base (withholding account/user names, of course).
We do not allow customers to make changes to questions in the standard survey; however, the
customer success director would be willing to listen to any feedback or suggestions that you may
have.
We do not send out reports of the customer satisfaction surveys. However, you can work with your
customer success manager to obtain the raw data results of the surveys. Our long-term plan is to
create a database that will create reports and dashboards, but that is not in place yet.
zzz) The Vendor shall describe its experience with large-scale K-12 service deployments.
Canvas currently has over 400 K-12 institutions representing 44% of our client base. Although
Instructure has had K-12 clients using Canvas since its initial launch, the Canvas K-12 LMS—
designed to meet the unique requirements of the K-12 environment—was publicly announced in
February 2012. Canvas’s corporate commitment to supporting and expanding our K-12 client base is
backed by a team of employees dedicated to Canvas K-12 product development, sales, and support.
While K-12 schools share many of the same objectives as higher education, there are differences
including:
•
Organizational structures
•
Classroom / instructional paradigms
•
Learner traits and behaviors
•
Safety and privacy
•
Parental involvement
To address these differences, Canvas K-12 provides a comprehensive set of features and functions to
meet specific requirements of the K-12 environment including:
Learning Analytics: To meet standards for Adequate Yearly Progress (AYP) under No Child Left
Behind, Canvas Learning Analytics can help identify at-risk students, allowing time for teachers and
administrators to intervene to help students’ progress. Learning Analytics provides administrators with
the tools they need to identify specific students, classes, or schools that need additional resources.
11 September 2014
Instructure, Inc.
91
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Parents have access to their child's learning analytics profile, which assists the student and parent in
identifying specific areas to improve.
Painless Standards Tracking and Reporting: Common Core State Standards (CCSS) can be
preloaded in Canvas to provide SDE with the ability to track mastery of CCSS. Canvas makes this
mandate painless: simply link the standards and objectives to assignments and quizzes, and the
mastery of standards and objectives is tracked automatically as part of the normal grading process.
Teachers save time by not duplicating effort and schools don't have to manage a separate reporting
system.
Parent Co-Enrollment: Canvas creates a parent account with every student account, including
parents by default in all class activities and communication. To protect privacy, parents cannot see
other students' work. Parent co-enrollment helps students, parents, and teachers communicate and
collaborate for the benefit of the student.
School Interoperability Framework: On April 10, 2014, Canvas announced they would be using
School Interoperability Framework (SIF) a new LMS-SIS integration service that is built on open
standards. These open standards will reduce the technical challenges for K-12 school districts by
simplifying how the LMS and SIS systems communicate (http://www.instructure.com/pressreleases/instructure-calls-for-collaboration-in-education-with-new-sif-integration-for-canvas-lms).
One of the ways that Instructure measures the quality of our support to K-12 schools and school
districts collectively is the quality of the user experience of individual teachers, students, course
designers, and administrators. We regularly survey our customers to ask them why they chose
Canvas and if Canvas is meeting their expectations and requirements. Below is a sample of some of
the feedback from our K-12 customers:
• “In our evaluation, Canvas outscored all other LMS products. When we tested the product,
the interface was very intuitive and it has very tight integration with our Google Apps for
Education implementation. The way it integrates, evaluates, and reports learning outcomes is
unmatched.”
-Bob Munson, Technology Coordinator, Grundy Center Community Schools
• “Rockingham held big expectations for Canvas, and I’ve been extremely pleased with its
performance and the reaction of our teachers. Our implementation process has been a huge
success; we’re looking forward to a long future with Canvas.”
-Dennis Frye, Dir. of Instructional Tech & Media, Rockingham County School District
• “Canvas is powerful software with a simple look and feel. The K-12 product debuted at the
top of the charts and is only getting better. Our teachers and students found it very easy to use
without any formal training. The Instructure support staff was outstanding helping us integrate
our SIS in our Canvas pilot. Canvas is just easy to use.”
-Mike Crawford, Online Learning Assessment & Collaboration Administrator, Sioux City
Community Schools
11 September 2014
Instructure, Inc.
92
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
To learn more about K-12 success stories, visit http://www.instructure.com/stories-k-12.
aaaa) Vendor shall describe any other features of the proposed LMS service that may not be included
in the requirements.
Modules:
The Modules tool provides exceptional flexibility for organizing lessons. Modules can be thematic,
focused on a specific topic or content type, or arranged chronologically to provide a course sequence
with support for selective release. The Modules tools supports drag-and-drop of module items for
easy reordering and reorganization.
Figure 51 Canvas Modules.
Course modules can be selectively released based on release date as well as prerequisites and/or
completion requirements based on the content and learning activities in the module. Figure 51 shows
the Module Settings interface. Selective release of Modules provides the ability to activate and
inactivate entire sets course content and activities.
11 September 2014
Instructure, Inc.
93
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Figure 52 Selective Release of Course Modules
Canvas Modules enforce progression and completion of a course timeline as defined by the instructor.
Modules enable instructors to specify prerequisites—including assessment/assignment scores—that
support the release of course content based on the satisfactory completion criteria of preceding
modules. In addition, assignments, assessments, announcements, discussions, and other classwork
and activities can be released and locked based on specified date/times.
11 September 2014
Instructure, Inc.
94
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Figure 53 Specifying Module prerequisite and completion criteria.
The Module Progress by Student window shows the progress of each learner in a course. The
window is split into two columns. The left column lists all learners and shows which module each
learner is working on [1]. Click the names of learners to view their progress. Learner progress displays
within the right column and shows the state of each module [2].
11 September 2014
Instructure, Inc.
95
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Figure 54 Module progress by student.
Modules can be completed, in progress, or locked. Modules that have no completion requirements, or
modules where the learners have completed the requirements, will be marked as completed. If a
learner is in the middle of a module, the module will be marked as “in progress,” and any outstanding
requirements can be viewed. If a module cannot yet be accessed by the learner because of
completion or prerequisite requirements, the module will be marked as locked.
Canvas also provides user access and activity reports. The course People tool provides a central
location for user Access, Interactions, Outcomes, and Grades reports as shown in Figure 55. The
Reports tool in the Canvas Administrator’s dashboard includes the following reports: Students with No
Submissions, Students Access Report, Last User Access, and Zero Activity.
Figure 55 User reports in the course People tool.
Rich Content Editor
Canvas offers an intuitive, powerful Rich Content Editor that makes incorporating multimedia easy.
Multimedia is easily embedded and recorded through Canvas’s Rich Content Editor. The Rich
Content Editor embeds and records video, audio, and images. Video and audio can be recorded
11 September 2014
Instructure, Inc.
96
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
directly into the content, using the camera and microphone of the user’s browser-enabled computing
or mobile device.
In the Rich Content Editor, icons for YouTube, Flickr, EQUELLA, and other content repositories can
be added to the toolbar for easy access to these sources. The simplicity of sharing media makes it
easier to make every part of the course more engaging. The Rich Content editor is used to create all
types of content including assignments, quizzes, the ePortfolio, pages, etc.
Figure 56 Rich Content Editor Interface
The Experience
It isn’t really one feature that makes Canvas special. It is all of the features working together to allow
for creativity and innovation. The one thing that stands out about Canvas is how intuitive and user
friendly it is. You can easily create a course in a matter of hours. The other surprising thing is that it is
actually fun to create a course in Canvas. The course creation tools in Canvas open up new
possibilities for designing course activities, incorporating different types of media, and overall, just
engaging students. Nothing can really capture the actual experience of working on Canvas, so we
hope that you will give us the opportunity to let you see it in action.
11 September 2014
Instructure, Inc.
97
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
3.1
LMS Desirable Features
These features are desirable, but not required. The Vendor may describe how their service would
provide the stated functionality. Please be detailed.
a) Integration with an alert system that includes sending Short Message Service messages. E.g.
FAB SMS, Simplified Alerts, etc.
Canvas messaging, announcements, alerts, and notifications are sent to users’ Recent Activity
Streams and Inboxes in their Canvas dashboards (which are fully accessible with the mobile apps) as
well as to any communication channels specified in individual user’s notification preferences. As a
message broker, Canvas transparently routes all messaging and notifications among users,
regardless of the destination or delivery mechanism, including forwarding messages and notifications
to the mobile-accessible channels as specified in users’ individual notification preferences. Users can
specify one or more external communications channels—external email, SMS text, Facebook, Twitter,
LinkedIn—for each type of notification and the frequency they want to receive notifications for each
communications channel. Canvas notifications can be send to students who score below a certain
percentage on a quiz.
b) Integration with an online presentation and feedback tool (webinar).
Canvas Conferences provide webcasting and a collaborative presentation space including
audio/video participation, an interactive whiteboard, and synchronous chat as shown in Figure 57. The
ability to initiate and invite one or more participants to a Conference is based on the user role
permission “Create web conferences.” Canvas Conferences support one-to-one and many-to-many
participants for all user types. Conferences with outside participants are supported in public courses.
11 September 2014
Instructure, Inc.
98
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Figure 57. Canvas Conferences Interface
Conferences can be recorded. Conferences can be time-limited or unlimited for long-running
sessions. Presentation materials can be uploaded to the whiteboard which provides a set of drawing
tools with different pen widths, colors, geometric shapes, undo function, and eraser. Canvas also
supports integrations with third-party lecture capture and conferencing tools including Blackboard
Collaborate, Panopto, Echo360, Tegrity, WizIQ, Wimba, MeetingOne, and Adobe Connect.
c) Integration with an instant messaging tool.
Canvas provides a synchronous chat tool that allows course members to type in real-time. In
addition, Canvas integrates with several third-party synchronous communication tools such as
Cranium Cafe, Hoot.me, Scribbler and VoiceThread. Canvas Chat provides an integrated
synchronous chat tool as shown in Figure 58. All users logged into the system and in the same class
and/or group can “gather” in the chat room to share video, audio, and text communication using
familiar chat elements such as avatars, emoticons, and graphics. The Chat tool maintains a history
that instructors can view.
11 September 2014
Instructure, Inc.
99
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Figure 58. Canvas Chat Interface
d) Integration with third party course registration system. I.e. course catalog.
Canvas offers a course registration system as an optional product at an additional cost.
Catalog incorporates and combines all of the fundamental features and functions of a well-designed
website, course catalog, registration and enrollment processor, payment gateway, and certificate
authoring engine to be an easy-to-use, out-of-the-box e-commerce solution. For a complete
description please refer to Appendix E “Catalog – Registration and Payment Portal” starting on page
148.
11 September 2014
Instructure, Inc.
100
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
4
References
a) The Vendor shall provide three (3) references of customers utilizing the Vendor’s current,
fullyimplemented LMS service, preferably in a large-scale K-12 education setting.
b) Please do not provide references from customers using a service other than the one the Vendor is
proposing in response to this RFP.
c) For each reference, the Vendor shall provide the following information:
i. Customer name;
ii. Customer address;
iii. Current telephone number of a customer employee most familiar with the project;
iv. Brief summary of the project; and
v. Any other project related information the Vendor believes would be helpful in evaluating this
reference.
Contact information for five project references of similar size and complexity are provided in Table 12
through Table 16:
Table 12. Reference: Knox County Schools
Reference
Organization
Name
Knox County Schools
Address
PO Box 2188, Knoxville, TN 37901
K12 Enrollment
57,326
Contact’s Name
Steve Glenn
Contact’s Position
Technology Specialist
Contact’s Phone
856.594.1837
Contact’s Email
[email protected]
Table 13. Reference: Rock Hill School District 3
Reference
Organization
Name
Rock Hill School District 3
Address
PO Box 10072, Rock Hill, SC 29731
11 September 2014
Instructure, Inc.
101
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Reference
K12 Enrollment
17,717
Contact’s Name
Chris Smith
Contact’s Position
Director, Staff Development
Contact’s Phone
803.980.2092
Contact’s Email
[email protected]
Table 14. Reference: Rockingham County Schools
Reference
Organization
Name
Rockingham County Schools
Address
511 Harrington Hwy, Eden, North Carolina 27288
K12 Enrollment
13,700
Contact’s Name
Merea Bridges
Contact’s Position
Instructional Technology Specialist
Contact’s Phone
336.342.1823
Contact’s Email
[email protected]
Table 15. Reference: Utah Educational Network
Reference
Organization
Name
Utah Educational Network
Address
101 Wasatch Drive, Salt Lake City, Utah 84112
Contracted FTE
34,000
Contact’s Name
Scott Allen
Contact’s Position
Learning System Admin
Contact’s Phone
801.581.5382
Contact’s Email
[email protected]
11 September 2014
Instructure, Inc.
102
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Table 16. Reference: Katy ISD – Virtual School
Reference
Organization
Name
Katy ISD – Virtual School
Address
P.O. Box159, Katy, Texas 77492
Users
59,078 (Contracted for 1000)
Contact’s Name
Susan Smith
Contact’s Position
E-Learning Coordinator
Contact’s Phone
281.396.2283
Contact’s Email
[email protected]
11 September 2014
Instructure, Inc.
103
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
5
Financial Information
Canvas is financially sound. In addition to building and expanding a profitable client base, Instructure
is backed by private investment for stability and growth. Instructure’s principal investors include CEO
Josh Coates and the venture capital firms Bessemer Venture Partners, Epic Ventures, and OpenView
Venture Partners. Instructure has no pending or known potential litigation or actions that may affect
our financial capability.
To protect the interests of investors, Instructure, as a closely held, private corporation, requires the
execution of a Non-Disclosure Agreement before providing more specific financial information. A Nondisclosure agreement can be provided upon request.
11 September 2014
Instructure, Inc.
104
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
6
Cost Proposal
1) The cost proposal shall be for the delivery of a fully functioning Production LMS service as
described in this RFP and shall be in the format specified below using the LMS Service Cost
Template.
The completed LMS Service Cost Template is provided on the following page.
11 September 2014
Instructure, Inc.
105
Canvas by Instructure
Vendor ______________________________
RFP #40-IT00103-14
LMS Service Cost Template
Text
Item Cost Description
1
Section III.4.b-h - Planning, Installation,
Integration and Configuration (Production
Ready) – Total one time dollar amount
2
Section III.4.a - NCVPS content migration of
courses from Moodlerooms Joule and
Blackboard Learn [not included in Item 1]
3
Total One Time Costs
(sum of items 1 and 2)
4
Annual subscriber fee – the per subscriber
per year cost available to NCVPS, all LEAs,
and all Charter Schools in North Carolina
5
Scaling Factors for Subscriber Fee
Please describe any factors that would affect
the annual subscriber fee, i.e. Any price
decreases as the subscriber base increases.
Dollar Amount
$75,000
Included
Includes Premium Implementation, Course
Migration, 3 Days On-Site training, Multiple days
Onsite Implementation and Setup including
Authentication Setup, Custom Branding, Premium
Support, Marketing support and Adoption
Planning.
Included in Item 1
$75,000
$3.74/user/year Canvas subscription fee for NC LEAs
NCDPI (NCVPS, PD, etc.) will receive
$3.74
Canvas licenses at NO COST
(up to 150K total yearly users)
AllT include 24/7/365 Support
$3.74/user/year flat-rate subscription fee for NC LEAs.
Each LEA will be responsible for paying year-1 implementation fees
NCDPI (NCVPS, PD, etc.) will receive Canvas licenses at NO COST
(up to 150K yearly users). The implementation fee detailed on line 1
is the only direct cost to NCDPI and includes unlimited storage.
Please refer to Section 6.1 and Section 6.2 "Canvas Implementation Service Package" for a
description of Premium Implementation.
Page 20 of 55
04/17/2014
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
6.1
Canvas Subscription Fee Inclusions
Table 17 lists the features and services included in the Canvas subscription fee.
Table 17. Canvas Subscription Inclusions Breakout
Canvas Subscription Inclusions
Comprehensive and Complete
Hosting Services
Synchronous/Asynchronous
Learning Components
Communication Utilities
Migration Tools
Analytics/Reporting Tools
Test/Training Instance
Mobile Support and Apps
Rubrics & Outcomes
Content Management
ePortfolios
Cross-Listing Support
PowerSchool Integration
Support
SpeedGraderTM and Gradebook
Web Conferencing
Unlimited Storage
Open API
Analytics Toolset
6.2
Canvas Implementation Service Package
Instructure’s Canvas Implementation Services Packages provide service options to meet each client
institution’s implementation requirements—ranging from minimal support and guidance to full project
ownership and management by Instructure. The Premium Implementation Service Package is
outlined in Table 18 and Table 19.
Table 18. Canvas Implementation Services Packages
Package
Services
Target Audience
Instructure leads the project and comes
Premium
on-site, leveraging proven best
Implementation practices to ensure the project is driven
Services
effectively to a successful conclusion.
11 September 2014
Instructure, Inc.
Institutions that desire the fastest
implementation based on Instructure’s
proven best practices and that want
Instructure to drive the implementation
project.
106
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Table 19. Canvas Implementation Services Package: Services, Duration, and Price
Package
Premium
Implementation
Services
Included Services
Typical Duration
 Canvas production account and test/training
instance setup
4 to 8 weeks
(24 weeks max.)
 Weekly call with assigned Implementation
Consultant
 General implementation assistance with
guidance, assistance, and troubleshooting of
client-initiated course migrations, third-party
tools integrations, and account settings.
 Standard Online Training Package comprising
remote training webinars: 2 hour Admin, 1
hour Support, 2 hours Instructor training
 Sample project plan, access to guides, public
courses, and best practices documentation
 Authentication integration support with access
to guides and assistance troubleshooting
client-initiated LDAP, SAML, and CAS
integrations
 Site branding support with guidance,
assistance, and troubleshooting of clientinitiated branding
 Basic SIS integration support with guidance,
assistance, and troubleshooting of clientinitiated SIS integration
 Support services implementation with creation
of Zendesk account(s) for the client, or set up
forwarding ticket emails to their existing help
desk system, and training on Zendesk
management
 Implementation Team including project
manager, trainer, and technical experts
 Weekly project status meeting
 Standard Online Training Package and three
days of on-site training
 Import up to 5,000 courses1, implement
11 September 2014
Instructure, Inc.
107
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Package
Included Services
Typical Duration
authentication, handle branding, and lead
internal marketing activities with Canvas gear
to drive adoption
 In-person assistance from Implementation
Team for SIS integration implementation
1
Supported course migration formats: Blackboard 6-9x export .zip, Blackboard Vista/CE course, WebCT 6+ course, ANGEL
export .zip, Moodle 1.9 .zip, Desire2Learn export .zip, and Common Cartridge 1.0/1.1/1.2. Non-supported formats require
additional work by Instructure’s Professional Services at additional cost. Migration activities include the automated creation
of course shells and the automated import of content that maps to similar Canvas course content types. Quality assurance
and any necessary remedial cleanup of migrated courses and course content are the responsibility of the client. Any issues
identified will be managed through the standard technical support process. Optionally, Instructure offers course migration,
quality assurance, and remedial cleanup services through engagement with Professional Services as specified by an
additional statement of work.
6.3
Canvas Training Offerings
Instructure’s online Standard Training Package is included in the one-time implementation fee at no
additional cost. The online Standard Training Package comprises the following webinars:
•
C1. Admin Training
•
C2. Support Training
•
C3. Instructor Training
Please refer to Table 25 for a listing, descriptions, and costs of Instructure’s Canvas training offerings.
6.4
Canvas Support Packages
To provide NCDPI with the highest level of support, Instructure is proposing our Premium Support
package.
11 September 2014
Instructure, Inc.
108
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Table 20 provides a comparison of the services offered in the support packages offered by
Instructure.
11 September 2014
Instructure, Inc.
109
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Table 20. Canvas Premium Support Package
Premium Support
Cost
20% of annual subscription
fee or $2,500 minimum
Tier I Support
Faculty Support
10% of annual subscription
fees or $1,000 total minimum
$500 minimum
One-time setup fee
Online Canvas
Help Center
24/7/365
24/7/365
Email Support
(escalated tickets to Tier II &
III)
8-hour response time
8-hour response time
Toll-Free Phone Support
for LMS Admin
24/7/365
24/7/365
Authorized LMS Admin
Support Accounts 1
1
All Faculty
1 Additional
6.5
LMS Administrator support accounts are available for $500.00 per account per year.
Canvas Tier I Support
To provide institutions with the highest level of support, Instructure highly recommends our optional
Premium Support package and Tier I support. Client institutions that subscribe to the Premium
Support package and Tier I Support consistently and enthusiastically report to us that they are
extremely satisfied with the value, level of service, and cost-effectiveness of these services. We would
be happy to provide additional references of client institutions that subscribe to the Premium and Tier I
Support packages.
Tier I Support by Instructure’s Support team provides first-line help desk support to address and
resolve faculty user issues such as logging into Canvas, questions about Canvas features and
functions, and resolving other operational problems.
The institution’s faculty can contact Instructure’s Tier I Support staff 24/7 through online ticket
submission, chat, e-mail, or phone. The institution’s LMS administrator(s) have access to all user11 September 2014
Instructure, Inc.
110
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
submitted tickets and monthly usage reports. Instructure’s Tier I Support can be made accessible
through the institution’s own branded support portal. Table 21 lists Tier I support service levels.
Table 21. Canvas Tier I Support Service Levels
Service
Service Level
First contact resolution
Greater than 75%
Call abandon rate
Less than 10%
Phone
80% of calls answered in 60 seconds or less
Online chat
80% of chat requests answered in 120 seconds or less
Online form – email & help
desk ticket response
80% of tickets or emails responded to in 60 minutes or
less
2) The Vendor responding to this RFP shall deliver a solution that meets all of the RFP
requirements.
Yes, Canvas by Instructure will provide a solution that meets all of the RFP requirements as stated in
the proposal.
3) Charges for work performed by any Vendor, subcontractor or agent shall be included in the
cost responses.
Instructure is not using any subcontractor or agents.
4) Additional one-time costs shall include:
a) Onboarding of NCVPS – including:
i. Migration of 30 courses/content from NCVPS Moodlerooms Joule to the LMS service
Canvas is proposing Premium Implementation Services, which will provide for the migration of 30
courses/content from NCVPS Moodlerooms Joule to Canvas and additional implementation services.
Table 22 lists the Canvas Implementation Service packages and a description of the service provided.
Table 22. Canvas Premium Implementation Service Package
Package
Premium
Implementation
Services
11 September 2014
Services
Instructure leads the project and comes on-site, leveraging proven best
practices to ensure the project is driven effectively to a successful
conclusion.
Instructure, Inc.
111
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Table 23. Canvas Premium Implementation Service Package: Service, and Duration
Package
Premium
Implementation
Services
Included Services
 Canvas production account and
test/training instance setup
Typical
Duration
4 to 8 weeks
(24 weeks max.)
 Weekly call with assigned Implementation
Consultant
 General implementation assistance with
guidance, assistance, and troubleshooting
of client-initiated course migrations, thirdparty tools integrations, and account
settings.
 Standard Online Training Package
comprising remote training webinars: 2
hour Admin, 1 hour Support, 2 hours
Instructor training
 Sample project plan, access to guides,
public courses, and best practices
documentation
 Authentication integration support with
access to guides and assistance
troubleshooting client-initiated LDAP,
SAML, and CAS integrations
 Site branding support with guidance,
assistance, and troubleshooting of clientinitiated branding
 Basic SIS integration support with
guidance, assistance, and troubleshooting
of client-initiated SIS integration
 Support services implementation with
creation of Zendesk account(s) for the
client, or set up forwarding ticket emails to
their existing help desk system, and
training on Zendesk management
 Implementation Team including project
manager, trainer, and technical experts
 Weekly project status meeting
11 September 2014
Instructure, Inc.
112
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Package
Included Services
Typical
Duration
 Standard Online Training Package and
three days of on-site training
 Import up to 5,000 courses1, implement
authentication, handle branding, and lead
internal marketing activities with Canvas
gear to drive adoption
 In-person assistance from Implementation
Team for SIS integration implementation
Supported course migration formats: Blackboard 6-9x export .zip, Blackboard Vista/CE course, WebCT
6+ course, ANGEL export .zip, Moodle 1.9 .zip, Desire2Learn export .zip, and Common Cartridge
1.0/1.1/1.2. Non-supported formats require additional work by Instructure’s Professional Services at
additional cost. Migration activities include the automated creation of course shells and the automated
import of content that maps to similar Canvas course content types. Quality assurance and any necessary
remedial cleanup of migrated courses and course content are the responsibility of the client. Any issues
identified will be managed through the standard technical support process. Optionally, Instructure offers
course migration, quality assurance, and remedial cleanup services through engagement with Professional
Services as specified by an additional statement of work.
1
iii.
Migration of 74 courses from NCVPS Blackboard Learn to the LMS service
Migration of the 74 courses from NCVPS Blackboard Learn to Canvas is provided with the Premium
Implementation as shown in Table 23.
5) All one-time costs shall be specified as a firm fixed price.
The one-time cost is provided as a firm fixed price on the pricing sheet.
In addition to the LMS Service, the following additional one-time non-LMS service deliverables shall
be provided:
a) Migration of existing NCVPS courses from current LMS service(s) to proposed solution.
i. 30 courses in Moodlerooms Joule service.
Yes, the cost of migrating 30 Moodlerooms Joule courses is included in the price proposal.
ii. 74 courses in Blackboard Learn service.
Yes, the cost of migrating 74 Blackboard Learn courses is included in the price proposal.
b) Technical Implementation Plan.
Please refer to Table 3 “Implementation Plan” on page 28.
11 September 2014
Instructure, Inc.
113
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
c) Integration with NCLOR
Yes, Canvas has integration with EQUELLA.
i.
Teachers must be able to add content from the NCLOR to their course.
Yes, the Canvas and EQUELLA integration supports adding content to courses.
e) Integration with NC IAM Service.
Integration with NC IAM Services would be via the Canvas API. Canvas provides a fully documented,
secure, open RESTful API for querying and exporting Canvas data as well as accessing Canvas
functionality. Using the API, Canvas data is securely exposed for export in standard CSV or XML
format. Exported data can then be imported into various query, reporting, and analysis tools. The
documentation for the Canvas API is publicly available at:
https://canvas.instructure.com/doc/api/index.html.
i.
Single sign-on.
Canvas supports centralized identity management and delegated authentication via integrations with
external identity providers (IdPs) including Lightweight Directory Access Protocol (LDAP), Active
Directory, Central Authentication Service (CAS), Security Assertion Markup Language (SAML) 2.0,
and Shibboleth. Canvas supports federated identity management and Single Sign-On (SSO) via
integrations with SAML, Shibboleth, and CAS. Additionally, user ID and password credentials from
any third-party system can be synchronized with Canvas-internal, local authentication via the Canvas
open API.
Canvas-internal authentication can be used alone or concurrently with any of the supported external
IdPs identified above. For example, when used concurrently with LDAP Canvas first presents user
credentials to the external IdP. If authentication fails, Canvas then looks up the credentials using its
internal authentication service. If authentication fails again, Canvas will deny the user login.
e) Integration with PowerSchool.
i. Course/class provisioning.
The Canvas implementation service includes the configuration and testing of our turn-key integration
with PowerSchool (version 7.2 or later) for one-way creation and synchronization of teacher and
student accounts, courses, sections and enrollments. The scheduled synchronization generally occurs
nightly at 2:00 AM MST/MDT but can be modified to accommodate the clients needs.
ii.
Grade book synchronization.
Instructure is committed to and actively developing grade book synchronization as part of our
PowerSchool solution. This future solution will allow teachers to selectively choose which
assignments to “Post to SIS” and to synchronize the selected assignments and their associated
grades to PowerSchool on demand without the need for manual export/import.
11 September 2014
Instructure, Inc.
114
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
f)
Plan for onboarding new LEAs or Charter Schools that opt-in to the service.
Please refer to Table 3. Implementation Plan starting on page 28.
i.
Include details for current NC LEAs or Charter School customers.
Table 24. Current LEAs or Charter School Customers
Canvas Accounts
Tyrrell County Schools
Burke County schools
Charlotte Christian School
Perquimans County Schools
Warren County Schools
Franklin Academy-North Carolina
North Carolina School of Science and Mathematics (NCSSM)
Edenton-Chowan Schools
The NC Center for the Advancement of Teaching
Yadkin County Schools
St. Mary’s School
Rockingham County Schools
ii. Include training for instructional technologists and teachers.
Canvas has included 3 days of On-site training in the price proposal in addition to Canvas’s online
Standard Training Package comprises the following webinars:
•
C1. Admin Training
•
C2. Support Training
•
C3. Instructor Training
g) Capacity testing plan, testing, and final report ensuring the service can meet uptime and access
requirements.
Please refer to Appendix B “Master Subscription Services Agreement” for uptime and access
requirements.
h) Communication and marketing plan/recommendations.
Canvas provides excellent examples of communication and marketing plans that other districts have
used to help rollout Canvas please refer to Canvas Strategies.
11 September 2014
Instructure, Inc.
115
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
7
Conflict of Interest
i.
Provide a statement that no assistance in preparing the response was received from any
current or former employee of the State of North Carolina whose duties relate(d) to this
RFP, unless such assistance was provided by the state employee in his or her official
public capacity and that neither such employee nor any member of his or her immediate
family has any financial interest in the outcome of this RFP;
We received no assistance from any current or former employees of the State of North Carolina in
preparing our response to RFP No.40-IT00103-14.
ii.
State if the Vendor or any employee of the Vendor is related by blood or marriage to an
Agency employee or resides with an Agency employee. If there are such relationships, list
the names and relationships of said parties. Include the position and responsibilities within
the Vendor's organization of such Vendor employees; and
No Instructure employees are related by blood or marriage to an Agency employee and no Instructure
employees reside with an Agency employee.
iii. State the employing State Agency, individual’s title at that State Agency, and termination date.
N/A
11 September 2014
Instructure, Inc.
116
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
8
Vendor’s Additional Terms and Conditions
Notwithstanding anything to the contrary contained in the RFP or Instructure’s proposal response to
the RFP, should Instructure be awarded the contract, Instructure will negotiate in good faith the terms
and conditions of a written agreement mutually satisfactory to both parties. Instructure believes,
however, that any agreement should recognize that:
1. Canvas, Instructure’s fully hosted learning management system (LMS), is provided as a
subscription cloud service over the Internet.
2.
Instructure requires full payment of annual subscription fees in advance.
3. Instructure considers an RFP to be the specification of a client institution’s functional and
technical requirements for an LMS. Our proposal response is a detailed description of how the
Canvas LMS and education technology platform and Instructure’s support and hosting services satisfy
the RFP’s requirements. Because the client institution’s RFP and Instructure’s proposal response are
not structured, organized, or written in terms of rights and obligations of the parties, Instructure does
not automatically incorporate those documents into the final contractual agreement. Instructure is,
however, open to negotiations to identify relevant portions of the RFP and the proposal response for
the mutually agreed upon inclusion of such portions within the final agreement.
In creating our Master Subscription Services Agreement (MSSA) which is provided in Appendix B,
Instructure has ensured that the rights and protections of both parties are addressed and clearly
delineated in a mutually beneficial and balanced agreement. In our MSSA, we have incorporated
clauses that reflect the best practices of the cloud-based subscription software industry including:
a)
Service level agreement with credit/refund language,
b) Family Educational Rights and Privacy Act (FERPA) compliance and the “school official”
exception,
c)
Confidentiality of information provided by the institution,
d)
Ownership of content provided by the institution, and
e)
Return of content and data to the institution.
Instructure’s Master Subscription Services Agreement (MSSA) provides rights and protections to both
our clients and to Instructure. The MSSA governs the delivery of the subscription Canvas cloud
service, support terms, warranties, infringement indemnity, compliance terms (including FERPA),
service level agreement, data ownership, use of subcontractors, and other standard terms and
conditions for an agreement of this type.
A copy of our Master Subscription Services Agreement is provided in Appendix B.
11 September 2014
Instructure, Inc.
117
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
9
Errata and Exceptions
Instructure acknowledges North Carolina Department of Public Instruction’s RFP contains language
limiting the ability to add to or modify the proposed terms and conditions, however Instructure believes
these terms and conditions do not cover all the intricacies regarding a Software as a Service (SaaS)
offering.
Please refer to Section 8 and Appendix B for Exceptions.
11 September 2014
Instructure, Inc.
118
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
10 Copy of Vendor’s License and Maintenance Agreements
Please refer to Appendix B “Master Subscription Services Agreement.”
11 September 2014
Instructure, Inc.
119
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
11 Other Supporting Material Including Technical System Documentation
The Canvas Help Center can be accessed by clicking the Help button in the Canvas interface or
directly at http://help.instructure.com. The Canvas Help Center is available 24/7/365 to administrators,
faculty, and students. It contains links to Canvas Guides, video tutorials, FAQs, user-group specific
help, discussion boards, release notes, and Canvas Communities sites, including Google Groups,
Facebook, Listserv, Open Source, and client-specific communities.
Canvas Guides are an extensive set of user and technical documentation. The categories of Canvas
Guides include:









Getting Started
Canvas Student Quickstart Guide
Canvas Instructor Quickstart Guide
Canvas Student Guide
Canvas Observer Guide
Canvas Instructor Guide
Canvas Designer Guide
Canvas Admin Guide
Canvas Video Guide
The Canvas Help Center also includes online training delivered as video tutorials, text-based tutorials,
new release screencasts, and Canvas courses.
Figure 59. Canvas Help Center
11 September 2014
Instructure, Inc.
120
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
12 Training and Other Materials, Samples or Examples
Instructure is offering 3 days of onsite training included in the cost proposal. Instructure’s online
Standard Training Package is included in the implementation services packages at no additional cost.
The online Standard Training Package comprises the following webinars:
•
C1. Admin Training
•
C2. Support Training
•
C3. Instructor Training
Instructure’s Training team will customize onsite employee training to meet the District’s requirements.
Please refer to Figure 25for a listing and descriptions of Instructure’s training offerings.
Table 25. Canvas Training Offerings Menu
In-Person/On-site
A1. Face-to-Face
Training
 Duration: 1 or more days
 Cost: $3,000 per day
plus travel expenses
Can be held at Instructure’s Salt Lake
City office or on-site at any location.
Institutions choose from a variety of
hands-on workshop and presentation
topics to create a personalized training
agenda. A typical day of training
includes six hours.
Online (asynchronous)
B1. Intro to Canvas
for Instructors –
Online Course
 Duration: 2 weeks
 Cost:
1 – 20 people: $150 per
seat
21 – 40 people: $140 per
seat
41 – 55 people: $130 per
seat
56 – 65 people: $120 per
seat
66 and up: $100 per seat
Introduces instructors to Canvas
fundamentals and provides an
opportunity to build and configure a
course step-by-step. Participants learn
how to navigate the Canvas interface,
customize courses, create a syllabus,
upload files, create assignments and
quizzes, use assessment tools, and
more.
Webinars (real-time)
C1. Admin Training
 Duration: 2 hours
 Cost: Initial included,
additional $600
11 September 2014
Instructure, Inc.
Instructs LMS Admins how to configure
the administrative settings in Canvas.
Participants learn how to manage
users, sub-accounts (domains),
121
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
courses and enrollments, as well as
how to organize courses, manage
users and permissions and create
shared content that can be used by
teachers.
C2. Support
Training
 Duration: 1 hour
C3. Instructor
Training
 Duration: 2 hours
C4. Canvas
Essentials Training
 Duration: 1 hour
C5. Canvas
Course Design
Training
 Duration: 1 hour
C6. Assessment &
Grading Training
 Duration: 1 hour
11 September 2014
 Cost: Initial included,
additional $300
 Cost: Initial included,
additional $600
 Cost: $300
 Cost: $300
 Cost: $300
Instructure, Inc.
Teaches local support personnel how
to troubleshoot problems and support
end users. Participants will learn how
to utilize Canvas documentation,
interact with the user community and
effectively use the help ticketing
system.
Provides instructors with an overview
of basic Canvas functionality, including
account settings, notification
preferences, messaging students,
uploading files, editing pages,
customizing the course navigation and
building assignments. Participants also
learn the basics of quizzes,
discussions, analytics and grading.
Introduces all types of users to the
Canvas interface. This session
includes a descriptive tour of Canvas
features followed by a more in-depth
look at how to build courses and
manage course settings.
Provides instructors with sample
design strategies they can use to
organize assignments, discussions,
quizzes and content into an easy-tonavigate course. Participants will also
learn how to use Canvas assessment
tools and analytics.
Introduces instructors to features they
can use to provide assessment,
feedback and grades to students.
Participants learn how to use
Outcomes, Rubrics, SpeedGrader™
122
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
and the Gradebook.
C7. Migration
Strategies Training
 Duration: 1 hour
C8. Collaboration
Training
 Duration: 1 hour
C9. Course
Delivery Training
 Duration: 1 hour
C10. Training
Strategies
 Duration: 1 hour
C11. Canvas Open
Q&A Session
 Duration: 2 hours
11 September 2014
 Cost: $300
 Cost: $300
 Cost: $300
 Cost: $300
 Cost: $600
Instructure, Inc.
Prepares instructors and/or support
personnel to move existing course
content from other learning
management systems to Canvas.
Participants learn how to import
content and discuss migration
strategies employed by other Canvas
users. This webinar is best suited for
institutions preparing to migrate from
Blackboard Learn or Blackboard Vista.
Introduces instructors to collaboration
features in Canvas, including
discussions, group assignments,
Canvas Collaborations and
Conferences. Participants will discuss
how these tools can be used to
enhance their class activities.
Prepares instructors who will facilitate
pre-designed courses in Canvas.
Participants will learn how to adjust
account settings, navigate the Canvas
interface, grade student work, manage
the course roster, access Canvas
support and communicate with their
students.
Introduces training strategies used by
other Canvas community members.
Participants compare and discuss the
needs of their institution and explore
which training initiatives might work
best for them. They also learn about
the training materials and opportunities
provided by Instructure and the greater
Canvas community.
Designed for client stakeholders to ask
specific questions about Canvas
related to their institution’s specific
needs. One hour of the session is
customized to the institution. Additional
123
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
topics covered may include, but are not
limited to, peer review, student groups,
grades and reporting, assessment,
analytics, LTI tools and admin
functionality.
Canvas Authorized Trainer Program (CAT)
The Canvas Authorized Trainer Program (CAT) provides a professional development
opportunity for education technology professionals to formalize their continued learning of the
Canvas learning platform. The program’s three levels motivate participants to connect with a
larger network of trainers and to develop and deliver training that will best suit the needs of
their local learners.
D1. Level 1 CAT
Preparation Course
 Duration: Ongoing
D2. Level 2 CAT
Curriculum Course
 Duration: 8 weeks
D3. Level 3 CAT
Renewal Course
 Duration: Ongoing
 Cost: No fee (open
enrollment)
 Cost: $1,500
 Cost: $500
Challenges trainers to demonstrate
intermediate mastery of Canvas
fundamentals. Participants build a
Canvas course, develop training
deliverables, deliver and reflect on live
training sessions and log 40 hours
learning about Canvas and engaging
with the Canvas Community.
Prepares trainers who have completed
the Level 1 CAT Preparation Course to
demonstrate an advanced mastery of
Canvas fundamentals as they develop
local training sessions based on
template workshop materials.
Provides trainers with an opportunity to
demonstrate their ongoing mastery of
Canvas 12 months after achieving
Level 2 status. To maintain Level 3
status, participants are required to
submit an annual log of hours spent
learning Canvas. They are also
encouraged to publicly share an
ePortfolio with evidence of their expert
training skills.
Theme-based Training Packages
E1. Package 1:
Maximizing Canvas
11 September 2014
Includes these webinars: Canvas
Course Design (1 hour), Assessment &
Grading Training (1 hour) and
 Cost: $900
Instructure, Inc.
124
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Collaboration Training (1 hour).
E2. Package 2:
Corporate Partner
 Cost: $1,200
Includes these webinars: Canvas
Course Design (1 hour), Course
Delivery Training (1 hour) and Canvas
Open Q&A Session (2 hours).
E3. Package 3:
Train Your Trainers
 Cost: $1,200
Includes these webinars: Assessment
& Grading Training (1 hour), Migration
Strategies Training (1 hour), Course
Delivery Training (1 hours) and Canvas
Open Q&A Session (2 hours).
E4. Package 4:
Faculty Ultra
 Cost: $1,200
Includes these webinars: Canvas
Essentials (1 hour), Canvas Course
Design (1 hour), Assessment &
Grading Training (1 hour) and Canvas
Open Q&A Session (2 hours).
Volume Pricing Packages
F2. Jumpstart
Package
 Cost: $6,000
(discounted $1,000)
Includes these training options: 20
seats in Intro to Canvas for Instructors
Online Course (2 weeks), 2 sessions of
Instructor Training (2 hours each), 2
sessions of Collaboration Training (1
hour each), 1 session of Course
Delivery Training (1 hour), 1 session of
Assessment & Grading Training (1
hour) and 2 sessions of Canvas Open
Q&A Session (2 hours each).
F3. Premium
Package
 Cost: $10,000
(discounted $2,450)
Includes these training options: 1
Face-to-Face training session, 30
seats in Intro to Canvas for Instructors
Online Course (2 weeks), 2 sessions of
Canvas Essentials (1 hour each), 2
sessions of Canvas Course Design (1
hour each), 2 sessions of Assessment
& Grading Training (1 hour each), 1
session of Migration Strategies
Training or Training Strategies (1
hour), 2 sessions of Collaboration
Training (1 hour each), 3 sessions of
Canvas Open Q&A Session (2 hours
 Plus actual travel costs
for Face-to-Face training
11 September 2014
Instructure, Inc.
125
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
each) and 1 Canvas Authorized
Trainer credit.
11 September 2014
Instructure, Inc.
126
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
13 RFP Attachment 6 Responses
Attachment 6 Responses are provided on the following page.
All questions in Attachment 6 must be completed by the Vendor and returned as part of the Vendor
RFP response. Vendors may provide other information by category to assist in demonstrating the
level of architectural consistency.
1) Scalability:
a) Provide detailed diagrams with complimenting narrative describing proposed technical solution.
The Canvas architecture is a single instance, multi-tenant system designed to scale to tens of millions
of users. The Canvas "stack" is a dynamic scaling web application built with our own automated
scaling and automated provisioning technologies. Canvas is developed using Ruby on Rails and is
built on:
• The Ubuntu LTS operating system
• Apache2 + Passenger web and application server
• Cassandra and Redis NoSQL store and caching
• PgBouncer and PostgreSQL transactional database
Canvas is hosted on the state-of-the-technology cloud infrastructure provided by Amazon Web
Services (AWS). The AWS services used to host Canvas include Elastic Compute Cloud (EC2),
Elastic Load Balancing (ELB), Simple Storage System (S3), Elastic Block Store (EBS), Virtual Private
Cloud (VPC), Simple Email Service (SES), CloudFront, Identity and Access Management (IAM),
DirectConnect, and CloudSearch. All application nodes are hosted on the AWS EC2 and S3
infrastructure, making full use of the real-time redundancy and capacity capabilities offered.
Virtualization is provided by AWS EC2.
All data traffic in and out of Canvas is at least 128-bit SSL-encrypted. The AWS cloud infrastructure is
SAS70 Type II audited, Service Organization Controls 1 (SOC 1) reported and published under both
the SSAE 16 and the ISAE 3402 professional standards, ISO 27001 certified, Level 1 service provider
under the Payment Card Industry (PCI) Data Security Standard (DSS), and has achieved FISMAModerate operation level. Instructure uses three AWS regions: the US East (Northern Virginia) Region
with 5 EC2 Availability Zones, the US West (Oregon) Region with 3 EC2 Availability Zones, and the
EU West (Ireland) Region with 3 EC2 Availability Zones.
AWS data center electrical power systems are designed to be fully redundant and maintainable
without impact to operations, 24 hours a day, and seven days a week. Uninterruptible Power Supply
(UPS) units provide back-up power in the event of an electrical failure for critical and essential loads in
the facility. Data centers use generators to provide back-up power for the entire facility.
Data is stored redundantly in multiple data centers and multiple geographic regions across the country
through Amazon S3. The Canvas architecture replicates data in near real-time and data is backed up
11 September 2014
Instructure, Inc.
127
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
on a daily basis. Instructure creates daily offsite database backups of Canvas data and content
including media, file system data, course structures, coursework, analytics, rubrics, learning
outcomes, and metadata. Any restore of the system will not result in more than 10 minutes of data
loss.
The Canvas architecture is horizontally scalable, enabling it to respond to usage spikes in real-time
and to accommodate expanded, long-term usage. Canvas architecture also provides exceptional
resilience to and rapid recovery from component failure. The Canvas application, its media and file
storage, and its database are each independently redundant. If an application hosting node were to
fail, all traffic would transfer to living nodes. If load increases, Canvas's automated provisioning
system ensures that more hosting nodes are made available—either in response to increased load or
in anticipation of it—to handle it. The database and file stores are also horizontally scalable, adding
capacity for both additional storage and load as needed.
The tiers of the Canvas architecture—Load Balancers, Application Servers, Caching, Database,
Distributed File Store, and Rich Media Store—are described below:
Figure xx. Canvas Architecture
11 September 2014
Instructure, Inc.
128
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
b) Describe the largest production implementation by an existing customer that utilizes the proposed
technical solution.
On June 15, 2012 Instructure formalized a partnership with Cisco Networking Academy, which
operates in nearly 2,000 high schools, colleges, and universities across the United States, as well as
an additional 8,000 institutions in 165 countries around the world. The more than one million Cisco
Networking Academy students are using Canvas for its blended face-to-face and web-based
curriculum for the Cisco Certified Network Associate (CCNA), and Cisco Certified Network
Professional (CCNP) certifications, among others.
The reasons Cisco selected Canvas are in large measure the same reasons Canvas is an ideal fit for
NCDPI; an open education platform, built with technology native to the cloud that integrates easily
with other technologies and external providers, and is compatible with all primary operating systems
and major web browsers.
c) Describe the testing methodology used in the development of the proposed technical solution (e.g.
Performance, Load, Stress, Security, etc.).
Instructure continually tests performance, load, stress, and security capabilities to ensure reliability
and sustainability across all spectrums of Canvas.
Instructure’s security team conducts quarterly internal security audits of the Canvas code base and
Instructure’s production environment. Intrusion and penetration vulnerabilities are tested in
Instructure's internal quarterly security audits to render Canvas both secure and hardened against
Internet susceptibilities. Instructure employs attack prevention tools, including a network firewall, antivirus software, vulnerability scanning, penetration testing, encryption, and authentication and
authorization protection to discover vulnerabilities and protect the network from Internet attacks.
Regular vulnerability scans of the Canvas application and infrastructure are also conducted using
third-party tools, custom scripts, and open source tools. If any vulnerabilities are detected,
Instructure’s security and engineering teams work together to analyze, design, and develop the
required patch. Security-related patches to the operating system, application software, and libraries
are applied within one (1) week, except in high severity cases, where patches are applied within
twenty-four (24) hours by best commercial efforts. In most cases, the vulnerability can be fixed using a
hot patch without incurring any downtime whatsoever to the Canvas production environment.
External vulnerability and penetration testing reports can be found at:
http://help.instructure.com/forums/20382721-security-notices
All components of the Canvas product are also included in the test approach.
The scope of product testing includes:

Unit Testing – Validation of individual units of product code.
11 September 2014
Instructure, Inc.
129
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14









Integration Testing - Verifies function and reliability of the product code as it relates to
database and the web interface.
Functional Testing - Verifies that each feature of the application meets its requirements. For
example, a “Create Course” button should trigger the appropriate event when pressed.
User Acceptance Testing - Verifies that the product/project works in the customer expected
manner. It is critical that datasets and data are either identical or similar to customer/project
data, execution, scope and scenarios.
Performance Testing - Ensures that the system meets defined response times.
Load Testing - Creates a load greater than the expected customer demand on the system.
Bash - Ad-hoc testing in an attempt to find flaws and break the system.
Multi-User Testing - Similar to load testing but assures that an acceptable number users can
work within the system simultaneously.
Scenario Testing - Identifies customer scenarios that may not have been tested in previous
test cycles and processes.
Product Certification - Certification by the QA team that the product/project meets objectives
and requirements of the test plan.
Instructure applies an Agile testing methodology with an integrated Quality Assurance (QA) process to
the design, development, and maintenance of Canvas. Every day during the three-week cycle,
Instructure’s Engineering team holds a “stand-up” meeting to review progress and discuss any
concerns. Engineers write automated unit and integration tests to cover all new code that is written. In
addition, all code changes are run through the full Canvas QA test suite before they can be accepted
into the main product. Code changes are closely reviewed and must be peer-approved by other
Engineering team members before inclusion in the upgrade/update package.
After the three-week development cycle, all changes are deployed to an internal staging server for
additional QA testing. Instructure’s QA team reviews all associated tickets, uses black-box testing of
affected components, and also test standard application workflows. Notes are made on the internal
tickets for these changes as needed. Any bugs that are found must be fixed during this QA period,
otherwise the change is pulled for further development.
Prior to release to the Canvas production environment, all upgrade/update packages are released to a
beta environment where the users of our client institutions can test drive and comment on new and
changed features and functionality.
Preliminary release notes are generated for the upcoming release and made available to all users at
http://help.instructure.com/forums/337224-product-release-notes
Current and past release notes for the tri-weekly Canvas upgrade/update releases are available at
http://help.instructure.com/forums/337224-product-release-notes.
Past security notices for Canvas are available on the Security Advisory Forum of the Canvas
Community at https://help.instructure.com/forums/20382721-Security-Notices.
11 September 2014
Instructure, Inc.
130
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
d) Describe the ability of the proposed solution to scale both horizontally and vertically.
Canvas has the ability to scale both horizontally and vertically when necessary.
Canvas scales horizontally through continually tuned automated provisioning, adapting as necessary
to use appropriate resources to meet fluctuating demands in system traffic. This method of horizontal
scaling saves time, resources, and cost while eliminating the need to maintain an unnecessarily high
system capacity or to manually monitor traffic. (See 1e. for additional details)
Canvas also has the capability to scale vertically by increasing the instance size through the autoscaling capabilities of Amazon Web Services.
e) Describe how the proposed solution can be scaled to manage pilot, rollout, and growth rate
requirements.
The Canvas architecture is a single instance, multi-tenant system, designed to scale to tens of
millions of users as demand and system load fluctuates from pilot, rollout, and accelerated growth
rates.
Canvas achieves this performance through continually tuned automated provisioning. Automated
provisioning utilizes optimal computing resources through the early detection and accommodation of
usage spikes. When a spike is detected, system power is allocated among multiple servers to ensure
efficient operations even during peak usage times such as the start and end of academic terms.
Traditionally, provisioning computing capacities follow either a fixed model, where an organization is
forced to choose a fixed computing capacity upfront, or a Application Server Provider model (ASP),
where traffic must be manually monitored allocated to accommodate system load.
Figure xx. Fixed Provisioning Infrastructure
11 September 2014
Instructure, Inc.
131
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Figure xx. On-demand Provisioning Infrastructure
Canvas offers a better provisioning solution. As the only hosted LMS with a true, native cloud
implementation, Instructure’s state-of-the-art architecture utilizes automated provisioning which, as
the name suggests, automatically provisions computing resources in response to actual usage.
Figure xx. Instructure Automated Provisioning
Automatic provisioning is able to accommodate to peak usage times to maintain a positive and
consistent user experience. As system load increases, so too does the available system capacity, and
as usage decreases, automatic provisioning releases unnecessary capacity to create both a costefficient solution and extra savings for NCDPI.
11 September 2014
Instructure, Inc.
132
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
2) Adaptability:
a) Describe the overall architectural approach utilized to design the proposed solution (e.g. Service
Oriented, 3/N Tier, Composite Application).
Canvas is a single instance multi-tenant system developed using Ruby on Rails. Canvas utilizes the
Ubuntu LTS operating system, Apache2 + Passenger web and application server, Cassandra and
Redis NoSQL store and caching, and the PgBouncer and PostgreSQL transactional database.
Canvas is hosted on the state-of-the-technology cloud infrastructure provided by Amazon Web
Services (AWS). The AWS services used to host Canvas include Elastic Compute Cloud (EC2),
Elastic Load Balancing (ELB), Simple Storage System (S3), Elastic Block Store (EBS), Virtual Private
Cloud (VPC), Simple Email Service (SES), CloudFront, Identity and Access Management (IAM),
DirectConnect, and CloudSearch. All application nodes are hosted on the AWS EC2 and S3
infrastructure, making full use of the real-time redundancy and capacity capabilities offered.
Virtualization is provided by AWS EC2.
All data traffic in and out of Canvas is 128-bit SSL-encrypted. The AWS cloud infrastructure is SAS70
Type II audited, Service Organization Controls 1 (SOC 1) reported and published under both the
SSAE 16 and the ISAE 3402 professional standards, ISO 27001 certified, Level 1 service provider
under the Payment Card Industry (PCI) Data Security Standard (DSS), and has achieved FISMAModerate operation level. Instructure uses three AWS regions: the US East (Northern Virginia) Region
with 5 EC2 Availability Zones, the US West (Oregon) Region with 3 EC2 Availability Zones, and the
EU West (Ireland) Region with 3 EC2 Availability Zones.
b) Describe how the architectural approach and the technologies used enable solution adaptability.
Canvas’s architectural approach allows it remain innovative, adaptable, compatible, and relevant to
today’s programming standards.
While other legacy Learning Management systems were developed using outdated programming
protocols, Canvas was crafted from the ground up using modern tools and programming standards.
This approach allows Canvas to adapt quickly to new learning or teaching models, incorporate new
ideas and learning management approaches, maintain a consistent programming standard, and
remain at the forefront of innovation and education.
As a cloud-hosted solution, Canvas is versionless and naturally keeps all users up-to- without the
need for time consuming updates or user-installed patches. This architectural approach keeps
Canvas secure, adaptable, and provides all users with the same framework for collaboration, creation,
and communication.
Additionally, Canvas is an open source learning management system. As an open source solution,
Canvas is optimized for open standards. This allows designers and creators to easily add third-party
additions and functionality to enhance the Canvas experience to best address their needs through LTI
and API integration.
11 September 2014
Instructure, Inc.
133
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Finally, Canvas does not require Java, and uses a minimalistic approach to flash. This architectural
approach allows for greater utility and adaptability and allows teachers and users to connect across
multiple platforms and devices.
c) Describe the technology roadmap for the proposed solution.
Instructure is dedicated to the future of Canvas and invests 39.3% of its revenue into development
and research initiatives. This commitment to the future has led to the pioneering of many new features
and forced competitors to replicate Instructure’s innovations. Pioneered features include:
SpeedGrader, drag-and-drop functionality, personal notifications, course copy auto-dates, Google
Docs integration, and more.
An updated technology roadmap for Canvas can be found at: http://product.instructure.com/
d) Describe how the solution will be capable of adapting to meet changing business requirements.
Canvas was created to meet the needs of an ever-changing and evolving marketplace through a
dedication to research and development, open-sourced architecture designed around easy third-party
integration, and dynamic scalability manufactured to expand to the demands of the industry.
That’s why Canvas is—and will continue to be—the most adaptable, flexible, and innovative platform
available.
3) Secureability:
a) Describe how the solution can be deployed to provide layered access controls.
Canvas is at least 128-bit SSL-protected, ensuring that both inbound and outbound traffic, including
any sensitive or personally-identifiable information, is encrypted and secured.
Though Instructure recommends external authentication into Canvas when possible, Canvas supports
internal authentication (username and password) and several forms of delegated authentication.
Internal authentication can be used concurrently with any form of delegated authentication. If desired,
credentials from any third-party system can be synchronized with Canvas via its open API. Even when
external authentication is configured, accounts can be setup to utilize the internal authentication
mechanism.
Canvas also integrates with Single Sign-On (SSO) and federated authentication service providers,
including LDAP, Active Directory, CAS, and SAML/Shibboleth (as well as OpenID if it's being passed
through a gateway IdP such as SAML) to support centralized password/authentication administration.
Canvas internal authentication for secure user logon can additionally be used concurrently with any
form of delegated authentication.
Local authentication passwords must be 6 or more characters. Passwords created for Canvasinternally authenticated users, are never stored. Passwords are securely hashed via the SHA-512
cryptographic hash algorithm with a randomly generated "salt" value. The resulting “signature” and
11 September 2014
Instructure, Inc.
134
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
“salt” are then stored. When Canvas-internal users attempt to authenticate, their credentials are
passed through the same process and the resulting signature is checked against the stored signature.
This process is exclusively uni-directional and passwords cannot be derived from their stored
signature.
Canvas provides a consistent, end-to-end security infrastructure responsible for protecting all content
provided in and through the Canvas system. Access to user information, courses, course content,
files, and more is restricted by enrollment type and specific permissions. These permissions are fully
configurable by the institution's administrators and can differ between districts, schools, and other
levels of institutional hierarchy.
In addition to system-wide security, faculty can configure and manage the security of their courses'
content. Content, including assignments, files, discussions, and more can be "locked" by the faculty
to prevent student access.
b) Describe how the solution can be deployed to accommodate both an integrated or externalized
identity access and management solution.
Canvas supports centralized identity management and delegated authentication via integrations with
external identity providers (IdPs) including Lightweight Directory Access Protocol (LDAP), Active
Directory, Central Authentication Service (CAS), Security Assertion Markup Language (SAML) 2.0,
and Shibboleth. Canvas supports federated identity management and Single Sign-On (SSO) via
integrations with SAML, Shibboleth, and CAS. Additionally, user ID and password credentials from
any third-party system can be synchronized with Canvas-internal, local authentication via the Canvas
open API.
Canvas-internal authentication can be used alone or concurrently with any of the supported external
IdPs identified above. For example, when used concurrently with LDAP, Canvas first presents user
credentials to the external IdP. If authentication fails, Canvas then looks up the credentials using its
internal authentication service. If authentication fails again, Canvas will deny the user login.
Canvas clients are encouraged to use Canvas in concert with their preferred external idP in order to
best control and establish end-user security protocols. For Canvas-internal authentication, passwords
must be 6 or more characters. Passwords are never stored in plain text. Passwords are securely
hashed via the SHA-512 cryptographic hash algorithm with a randomly generated "salt" value. The
resulting signature and salt value are then stored. When users attempt to authenticate, their
credentials are passed through the same process and the resulting signature is checked against the
stored signature. This process is exclusively uni-directional and passwords cannot be derived from
their stored signature.
c) Describe the ability of the proposed solution to meet federal and state regulatory requirements.
Canvas was built to comply with the Family Educational Rights and Privacy Act (FERPA) by design
and readily integrates with other campus systems to prevent unauthorized access to FERPAprotected data. Whether implemented as a standalone system or as a fully integrated component of
11 September 2014
Instructure, Inc.
135
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
the campus IT/IS infrastructure, Canvas provides educational institutions and agencies with multiple
mechanisms and technologies to manage, enforce, and comply with the provisions of FERPA and to
fulfill their responsibilities under its requirements.
Additionally, the Canvas education technology platform and learning management system is hosted
on the state-of-the-technology cloud infrastructure provided by Amazon Web Services (AWS). The
AWS infrastructure is highly stable, fault-tolerant, and secure as attested by the following
certifications:





Statement on Auditing Standards No. 70 (SAS 70) Type II audited
Service Organization Controls 1 (SOC 1) reported and published under both the Statement on
Standards for Attestation Engagements 16 (SSAE 16) and the International Standard on
Assurance Engagements 3402 (ISAE 3402) standards
Certified ISO/IEC 27001:2005 Information technology – Security techniques – Information
security management systems – Requirements
Level 1 service provider under the Payment Card Industry (PCI) Data Security Standard (DSS)
Federal Information Security Management Act (FISMA) Moderate Authorization and
Accreditation received from the U.S. General Services Administration.
For additional information about AWS security certifications and standards compliance, please refer to
http://aws.amazon.com/security and http://aws.amazon.com/compliance/
4) Availability:
a) Describe the technologies and approach used to meet and/or exceed availability requirements.
Canvas is a versatile LMS that’s available on desktops, laptops, tablets, and mobile devices. Canvas
supports the latest two versions of Apple Safari, Google Chrome, Microsoft Internet Explorer, and
Mozilla Firefox and leverages the best and newest capabilities they provide.
The Canvas mobile app offers a rich user experience and provides a clean, intuitive, and reliable
interface to submit assignments, take quizzes, check grades, and participate in discussions and
learning activities. Students and faculty can further utilize the app to communicate and collaborate
through Canvas Conversations, keep up-to-date with assignments, quizzes, and announcements, and
provide and discuss feedback through text, audio, and their mobile device’s video functionality.
11 September 2014
Instructure, Inc.
136
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Figure xx. Canvas Android App
b) Describe an acceptable backup and recovery approach to meet and/or exceed availability
requirements
Canvas client data is backed-up automatically both in real-time and on a 24 hour schedule to multiple
geographic locations, rather than a single data center. This allows Instructure to provide superior
disaster recovery in the case of outages.
Most structured data—courses, user information, and assignments, for example—is stored in a
PostgreSQL database. This data is horizontally partitioned between instances based on account and
demand. Each database cluster has a Master and a Slave database, located in geographically
separate sites. The data from each Master is replicated asynchronously in near-real time to its
corresponding Slave. Each Master is also backed up completely every 24 hours, and the backup is
stored in a third geographically separate site. Files for static assets from courses and assignments are
stored on a scalable, protected, geographically redundant storage system (Amazon S3). Multiple
copies are stored by Instructure for backups.
5) Manageability:
a) Describe the versioning and patch management process for the proposed solution.
Canvas is a versionless cloud-hosted solution and automatically keeps all users up to date without
downtime (99.9% uptime guarantee), time consuming updates, or user-installed patches. This
11 September 2014
Instructure, Inc.
137
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
approach keeps Canvas secure, adaptable, and provides all users with the same framework for
collaboration, creation, and communication.
b) Describe approaches that could be implemented to provide overall performance monitoring for the
proposed solution.
Instructure continually monitors system performance and availability. In the unlikely event that system
performance degrades or the system becomes unavailable, Instructure initiates fail-over procedures to
redundant resources. Instructure’s Support and Engineering teams immediately work to analyze and
resolve any performance degradation as quickly as possible.
Canvas leads the industry with a 99.9% uptime guarantee. Further, Canvas is developed using an
agile methodology applying bug and security updates faster than non-cloud native platforms. On
average, Instructure takes only three weeks to apply bug fixes (other platforms generally take three to
six months to develop and apply fixes). Because Canvas is a cloud native platform, fixes for severe
issues can be released immediately without waiting for a scheduled release.
c) Describe the Quality Assurance (QA) measures that have been taken in the design,
implementation, and maintenance with respect to the proposed solution.
Instructure applies an Agile methodology with an integrated Quality Assurance (QA) process to the
design, development, and maintenance of Canvas. Every day during the three-week cycle,
Instructure’s Engineering team holds a “stand-up” meeting to review progress and discuss any
concerns. Engineers write automated unit and integration tests to cover all new code that is written. In
addition, all code changes are run through the full Canvas QA test suite before they can be accepted
into the main product. Code changes are closely reviewed and must be peer-approved by other
Engineering team members before inclusion in the upgrade/update package.
After the three-week development cycle, all changes are deployed to an internal staging server for
additional QA testing. Instructure’s QA team reviews all associated tickets, uses black-box testing of
affected components, and also test standard application workflows. Notes are made on the internal
tickets for these changes as needed. Any bugs that are found must be fixed during this QA period,
otherwise the change is pulled for further development.
Prior to release to the Canvas production environment, all upgrade/update packages are released to a
beta environment where the users of our client institutions can test drive and comment on new and
changed features and functionality.
Instructure additionally tests the functionality, reliability, and capabilities of Canvas product upgrades
and updates on supported web browsers and native mobile apps. The QA process comprises three
stages:
•
Test Approach Definition - to establish the overall strategy and scope of testing.
•
Test Requirements & Planning - to identify the activities, dependencies, effort, and resources
required to achieve test approach.
11 September 2014
Instructure, Inc.
138
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
•
Test Development and Execution - to manage and conduct the testing including:
o
Maintain test plan and schedule
o
Design unit, automated, and manual test cases to be run
o
Define the data required for tests
o
Create test environment
o
Execute tests through the testing scope and the testing cycles
o
Signoff when exit criteria have been met
The QA process is a dynamic process. As new requirements are identified, corresponding unit tests,
integration tests, regression tests, and all requisite test cases will be created.
d) Describe the management and monitoring tools that are supported by the proposed technologies.
Instructure continually monitors system performance and availability. In the unlikely event that system
performance degrades or the system becomes unavailable, Instructure initiates fail-over procedures to
redundant resources. Instructure’s Support and Engineering teams immediately work to analyze and
resolve any performance degradation as quickly as possible.
Instructure’s Engineering & Operations team maintains an Outage Log, a record of technical issues
with severity beyond the scope of Support technicians; such issues generally affect a significant
percentage of users. The Outage Log records data about each issue, including:
•
Date, time, and duration
•
Affected system(s)
•
Steps taken
•
Root cause
Significant events are reported to LMS administrators automatically (during and after the event) via
email; LMS administrators are added to the mailing list by their Account Manager.
6) Interoperability:
a) Describe the programming language(s) and development framework(s) that are utilized in the
design and implementation of the proposed solution.
Canvas is developed using Ruby on Rails built on:
•
Ubuntu LTS operating system
•
Apache2 + Passenger web and application server
•
Cassandra and Redis NoSQL store and caching
•
PgBouncer and PostgreSQL transactional database
11 September 2014
Instructure, Inc.
139
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Canvas is hosted on the state-of-the-technology cloud infrastructure provided by Amazon Web
Services (AWS). The AWS services used to host Canvas include Elastic Compute Cloud (EC2),
Elastic Load Balancing (ELB), Simple Storage System (S3), Elastic Block Store (EBS), Virtual Private
Cloud (VPC), Simple Email Service (SES), CloudFront, Identity and Access Management (IAM),
DirectConnect, and CloudSearch. All application nodes are hosted on the AWS EC2 and S3
infrastructure, making full use of the real-time redundancy and capacity capabilities offered.
Virtualization is provided by AWS EC2.
b) Describe any open (industry and/or de facto) standards utilized to ensure interoperability of this
solution within a heterogeneous environment.
Instructure’s approach and commitment to commercial open source makes us unique in the LMS
industry. We believe that open source is a critical part of the future of educational software. Closed
systems propagate vendor lock-in that inhibits innovation and prevents instructors and students from
taking advantage of the full potential of open web standards-based education technologies.
Canvas’s open, standards-based architecture supports compatibility or integration with any third-party
application, tool, or service that provides an open, standards-based technology integration,
connectivity, or content interchange such as LTI or Common Cartridge. Instructure’s Professional
Services team and our client institutions have designed and developed LTI-based integrations with
digital library systems and materials, electronic reserve systems, and research databases. Canvas
also provides out-of-the-box support for EQUELLA, a leading digital resources repository and
management system.
c) Describe the available options, along with the preferred approach, for integrating the proposed
solution with other intra/inter agency systems and NC Shared Services.
Canvas was specifically designed to integrate easily with a variety of academic and administrative
systems including Student Information Systems (SIS)/Student Information Management Systems
(SIMS), Enterprise Resource Planning (ERP) systems, and Human Resources Information Systems
(HRIS). Canvas supports integrations with Ellucian (formerly SunGard Banner or Datatel Colleague),
PeopleSoft, Jenzabar, CampusVue, Poise, PowerSchool, CampusKey, and other SIS/ERP/HRIS that
can export data that can be translated into the Canvas SIS data import format or sent directly to the
Canvas SIS application programming interface (API).
Canvas accepts SIS data in standard comma separated-values (CSV) and IMS Enterprise XML
formats. The following links detail the specifications for API-based SIS import:
•
Canvas API General: https://api.instructure.com
•
SIS Imports via API: https://canvas.instructure.com/doc/api/sis_imports.html
•
Canvas standard CSV: https://canvas.instructure.com/doc/api/file.sis_csv.html
11 September 2014
Instructure, Inc.
140
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
d) Describe the flexibility of this solution to meet future integration needs.
In order to facilitate the most integrations with the greatest flexibility possible, Canvas provides a
robust open API that securely expose Canvas data and functionality using REST. All API access is
over HTTPS using OAuth2 authentication. All API responses are in JavaScript Object Notation
(JSON) or CSV.
e) Describe how the solution meets accessibility (i.e. W3C and/or 508) requirements.
Canvas adheres to accessibility guidelines of Section 508 of the Rehabilitation Act as documented in
our Voluntary Product Accessibility Template (VPAT) publicly available at
http://www.instructure.com/canvas-vpat.
By using W3C's Web Accessibility Initiative (WAI) Web Content Accessibility Guidelines (WCAG) 2.0
AA, Accessible Rich Internet Applications (ARIA), and Authoring Tool Accessibility Guidelines
(ATAG), Instructure ensures that even the most interactive, dynamic widgets in Canvas are easy to
use with assistive technology such as JAWS (Job Access With Speech) and NonVisual Desktop
Access (NVDA).
Instructure continually strives to make Canvas a great experience for all users by ensuring the
accessibility of Canvas. Canvas avoids problematic content, such as Flash content, and even
converts math equations to MathML automatically. Utilizing the best Web 2.0 technologies and latest
standards, Canvas was developed with modern, semantic markup and accessibility techniques. Some
of the measures that Instructure takes to ensure the highest level of compliance are:
•
Client branding assistance to maintain Canvas’s compliance with contrast ratios, styles, and
color schemes
•
“Alt” tags in system images
•
Automatic tags for users’ images in content pane for creating content
•
Prompt for “alt text” when embedding external images
•
Rich Content Editor only provides styles when formatting text
•
Moderation of quizzes for individuals requiring more time or multiple attempts
7) Enterprise:
a) Describe how the proposed solution can leverage NC Shared Services.
Canvas was specifically designed to integrate easily with a variety of academic and administrative
systems including Student Information Systems (SIS)/Student Information Management Systems
(SIMS), Enterprise Resource Planning (ERP) systems, and Human Resources Information Systems
(HRIS). Canvas supports integrations with Ellucian (formerly SunGard Banner or Datatel Colleague),
PeopleSoft, Jenzabar, CampusVue, Poise, PowerSchool, CampusKey, and other SIS/ERP/HRIS that
can export data that can be translated into the Canvas SIS data import format or sent directly to the
Canvas SIS application programming interface (API).
11 September 2014
Instructure, Inc.
141
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
b) Describe how consolidation of services and infrastructure will be accomplished.
As a cloud-hosted solution, Canvas does not require a consolidation of services or infrastructure.
11 September 2014
Instructure, Inc.
142
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Instructure’s Terms and Conditions
Instructure acknowledges North Carolina Department of Public Instruction’s RFP contains language
limiting the ability to add to or modify the proposed terms and conditions, however Instructure believes
these terms and conditions do not cover all the intricacies regarding a Software as a Service (SaaS)
offering.
Notwithstanding anything to the contrary contained in the RFP or Instructure’s proposal response to
the RFP, should Instructure be awarded the contract, Instructure will negotiate in good faith the terms
and conditions of a written agreement mutually satisfactory to both parties. Instructure believes,
however, that any agreement should recognize that:
1. Canvas, Instructure’s fully hosted learning management system (LMS), is provided as a
subscription cloud service over the Internet.
2. Instructure requires full payment of annual subscription fees in advance.
3. Instructure considers an RFP to be the specification of a client institution’s functional and
technical requirements for an LMS. Our proposal response is a detailed description of how the
Canvas LMS and education technology platform and Instructure’s support and hosting services
satisfy the RFP’s requirements. Because the client institution’s RFP and Instructure’s proposal
response are not structured, organized, or written in terms of rights and obligations of the
parties, Instructure does not automatically incorporate those documents into the final
contractual agreement. Instructure is, however, open to negotiations to identify relevant
portions of the RFP and the proposal response for the mutually agreed upon inclusion of such
portions within the final agreement.
4. Because the MSSA provides for penalties if specified service levels are not met, Instructure
does not provide payment or performance bonds.
In creating our Master Subscription Services Agreement (MSSA) which is provided following this
page, Instructure has ensured that the rights and protections of both parties are addressed and clearly
delineated in a mutually beneficial and balanced agreement. In our MSSA, we have incorporated
clauses that reflect the best practices of the cloud-based subscription software industry including:
a) Service level agreement with credit/refund language,
b) Family Educational Rights and Privacy Act (FERPA) compliance and the “school official”
exception,
c) Confidentiality of information provided by the institution,
d) Ownership of content provided by the institution, and
e) Return of content and data to the institution.
11 September 2014
Instructure, Inc.
143
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Instructure’s MSSA provides rights and protections to both our clients and to Instructure refer to
Appendix B. The MSSA governs the delivery of the subscription Canvas cloud service, support terms,
warranties, infringement indemnity, compliance terms (including FERPA), service level agreement,
data ownership, use of subcontractors, and other standard terms and conditions for an agreement of
this type.
11 September 2014
Instructure, Inc.
144
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Appendix B.
Master Subscription Services Agreement
Instructure’s Master Subscription Services Agreement is provided following this cover page.
11 September 2014
Instructure, Inc.
145
Master Subscription Services Agreement
This agreement is between Instructure, Inc., a Delaware corporation (Instructure), and the entity or individual agreeing to these terms and identified in the signature line below (Customer). It is effective as of the date of the last signature set forth below. LEARNING MANAGEMENT SYSTEM SOFTWARE SERVICE. With a signed order, Instructure will provide its learning management system software as a service through a URL within a hosted server environment under the terms below (Service). This agreement contemplates one or more orders for the Service, which are governed by the terms of this agreement. User means a participant, instructor, or administrator of Customer’s organization, who is authorized by Customer to use the Service (and Customer has paid for this use) with login credentials. (1) USE OF SERVICE. a). Customer Owned Content. All information, data, results, plans, sketches, texts, files, links, images, photos, videos, audio files, notes, or other materials uploaded under Customer’s User accounts in the Service remain the sole property of Customer, as between Instructure and Customer (Customer Content). Customer grants Instructure the worldwide, royalty-­‐free right to use, publicly display, and distribute the Customer Content solely for purposes of performing its obligations under this agreement and providing and improving the Services. During the term of this agreement and for 3 months after expiration or termination, Customer may export the Customer Content through the API or by using the export feature within the Service. Instructure has no obligation to store the Customer Content 3 months after expiration or termination. b). API Access. Instructure provides access to its application-­‐programming interface (API) as part of the Service for no additional fee. Subject to the other terms of this agreement, Instructure grants Customer a non-­‐exclusive, nontransferable, revocable license to operate the API only for purposes of interfacing Customer’s technology applications or services with the Service as allowed by the API’s technical limitations and in accordance with the API Policy, as may be updated by Instructure from time to time. The Instructure API Policy is located at http://www.instructure.com/policies/api-­‐policy c). Customer Responsibilities. Customer (i) is solely responsible for Customer Content and all activities arising from its User accounts in the Service, (ii) must keep its passwords secure and confidential, and notify Instructure promptly of any known or suspected unauthorized access, and (iii) may use the Service only in accordance with applicable law and regulation. d). Customer Restrictions. Customer may not, and will use reasonable means to ensure that each User does not, i. sell, resell, rent, or lease the Service or API; ii. reverse engineer the Service or the API; iii. remove or modify any proprietary marking or restrictive legends in the Service; iv. use the Service to store or transmit infringing, unsolicited marketing emails, libelous, obscene, deceptive, defamatory, pornographic, racist, sexual, hateful, or otherwise objectionable (except as necessary for Customer’s instructional purposes, but in all cases in compliance with applicable law and regulation), unlawful or tortious material, or any other material in violation of a third-­‐party right; v. use the Service to harm or impersonate any person, or for any commercial purpose (including accessing the Service to build a competitive service or product, or copy any feature, function or graphic for competitive purposes); vi. interfere with or disrupt the integrity or performance of the Service; or vii. attempt to gain unauthorized access to the Service or their related systems or networks. e). Customer Support. Instructure must provide customer support for the Service under the terms of Instructure’s Customer Support (Support), which are located at http://www.instructure.com/policies/support-­‐terms. (2) PAYMENT TERMS. Customer must pay all fees as specified on the order, but if not specified then within 30 days of receipt of an invoice. Customer is responsible for the payment of all sales, use and other similar taxes. All orders are non-­‐cancelable and the fees are non-­‐refundable (except as expressly provided below). (3) WARRANTY/SERVICE LEVEL AGREEMENT AND REMEDY. a). Compliance with Laws. Each party represents and warrants to the other party that it will comply with all applicable laws and regulations (including all applicable export control laws and restrictions) with respect to its activities under this agreement. Instructure will implement reasonable and typical administrative, technical, and physical safeguards in an effort to secure its facilities and systems from unauthorized access and to secure the Customer Confidential Information (defined below) and data. Instructure agrees to only use or disclose personal information records created or received from, by, or on behalf of Customer or its Users for the purposes of (a) providing and improving the Services and in accordance with the Instructure Privacy Policy, except that Instructure may create, use, and disclose de-­‐identified and aggregated data based upon personal information records for its own purposes, (b) as permitted by this agreement, (c) as required by law or regulation, or (d) as authorized by Customer in writing. Notwithstanding the Rev. 03.01.14 1 foregoing, Instructure may access, preserve, and disclose User’s registration and any other information if required to do so based on Instructure’s good faith belief that such access, preservation, or disclosure is necessary to: (i) enforce this agreement; (ii) respond to claims of a violation of the rights of third parties, whether or not the third party is a User, individual, or government agency; (iii) respond to customer service inquiries; or (iv) protect the rights, property, or personal safety of Instructure, other users or the public. b). Service Availability Warranty. Instructure warrants to Customer, (i) that commercially reasonable efforts will be made to maintain the online availability of the Service for a minimum availability in a trailing 365-­‐day period as provided below (excluding scheduled outages, standard maintenance windows, force majeure, and outages that result from any technology issue originating from Customer or a User), (ii) the functionality or features of the Service may change but will not materially degrade during the Term, and (iii) that Support may change but will not materially degrade during the Term. Annual Availability Warranty: 99.9% availability percentage • If Customer has been using the Service for less than 365 days, the preceding 365 days will be used, but any days prior to Customer’s use
of the Service will be deemed to have had 100% availability.
• Any unavailability occurring prior to a successful credit claim cannot be used for any future claims.
A Customer is eligible for a service credit if the annual availability percentage drops below 99.9% for the preceding 365 days from the date of a service credit claim. The maximum amount of the credit is 1/12 of the annual subscription fee for a twelve (12) month period. This service credit is calculated by taking the number of hours that the Service was unavailable below the warranty, and multiplying it by 3% of 1/12 the annual subscription fee. Customer’s sole and exclusive remedy for breach of the warranty in this Section 3(b)(i) will be for Instructure to provide a credit as provided above; provided that Customer notifies Instructure in writing of such claim within the applicable month Customer becomes eligible or 30 days after. c). Third Party Links/Service Disclaimer. The Service may link to third party web sites (including without limitation, links provided by Users of the Service) or allow access to third-­‐party services (including without limitation, turnitin.com and Google docs). Such sites and services are not under the control of Instructure, and Instructure is not responsible for the content or any link on such sites or for the temporary or permanent unavailability of such third party sites or services. d). Warranty Disclaimer. EXCEPT AS EXPRESSLY PROVIDED IN THIS SECTION, INSTRUCTURE DISCLAIMS ALL WARRANTIES, WHETHER WRITTEN, ORAL, EXPRESS, IMPLIED, OR STATUTORY, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY, TITLE, NON-­‐INFRINGEMENT, AND FITNESS FOR A PARTICULAR PURPOSE. COMPANY DOES NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED OR BE ERROR-­‐FREE. (4) MUTUAL CONFIDENTIALITY. a). Definition of Confidential Information. Confidential Information means all confidential information disclosed by a party (Discloser) to the other party (Recipient), whether orally or in writing, that is designated as confidential or that reasonably should be understood to be confidential given the nature of the information and the circumstances of disclosure (Confidential Information). b). Protection of Confidential Information. The Recipient will protect the Confidential Information using the same degree of care that it uses to protect the confidentiality of its own Confidential Information (but in no event less than reasonable care). The Recipient shall not disclose or use any Confidential Information of the Discloser for any purpose outside the scope of this agreement. The Recipient must make commercially reasonable efforts to limit access to Confidential Information of Discloser to those of its employees and contractors who need such access for purposes consistent with this agreement and who have signed confidentiality agreements with Recipient no less restrictive than the confidentiality terms of this agreement. c). Exclusions. Confidential Information excludes information that: (i) is or becomes generally known to the public without breach of any obligation owed to Discloser, (ii) was known to the Recipient prior to its disclosure by the Discloser without breach of any obligation owed to the Discloser, (iii) is received from a third party without breach of any obligation owed to Discloser, or (iv) was independently developed by the Recipient without use or access to the Confidential Information. Notwithstanding any of the foregoing, the Recipient may disclose Confidential Information to the extent required by law or court order, but will provide Discloser with advance notice to seek a protective order. (5) PROPRIETARY RIGHTS. a). Reservation of Rights by Instructure. The software, workflow processes, user interface, designs, know-­‐how, API information, third party technology and other technologies provided by Instructure as part of the Service are the proprietary property of Instructure and its licensors, and all right, title and interest in and to such items, including all associated intellectual property rights, remain only with Instructure and its licensors. Instructure reserves all rights unless expressly granted in this agreement. b). Feedback. Instructure may contact each User (no more than once each year) for the sole purpose of seeking feedback regarding performance of the Service and suggestions for improvements (such feedback will be stored in anonymous and aggregate form). Customer, and each User (to the extent Customer has such right), hereby grants Instructure an irrevocable, royalty-­‐free perpetual license to use all feedback and suggestions regarding the Service. Rev. 03.01.14 2 (6) EXCLUSION OF DAMAGES AND LIMITATION OF LIABILITY. a). EXCLUSION OF CERTAIN DAMAGES. INSTRUCTURE AND ITS SUPPLIERS SHALL NOT BE LIABLE TO CUSTOMER FOR ANY INDIRECT, SPECIAL, EXEMPLARY, PUNITIVE, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF OR RELATED TO THIS AGREEMENT OR THE USE OR INABILITY TO USE THE SERVICES (INCLUDING, WITHOUT LIMITATION, COSTS OF DELAY, LOSS OF DATA, RECORDS OR INFORMATION, AND ANY FAILURE OF DELIVERY OF THE SERVICE), EVEN IF INSTRUCTURE HAS BEEN NOTIFIED OF THE LIKELIHOOD OF SUCH DAMAGES. b). LIMITATION OF LIABILITY. EXCEPT FOR INSTRUCTURE’S INTELLECTUAL PROPERTY INDEMNITY OBLIGATIONS IN SECTION 9, INSTRUCTURE’S MAXIMUM LIABILITY FOR DAMAGES ARISING OUT OF OR RELATED TO THIS AGREEMENT (WHETHER IN CONTRACT, TORT OR OTHERWISE) SHALL NOT EXCEED THE AMOUNT PAID BY CUSTOMER WITHIN THE PRECEDING 12 MONTHS UNDER THIS AGREEMENT. (7) TERM, TERMINATION, AND SUSPENSION OF SERVICE. a). Term. This agreement continues for the duration specified on the order (Term). b). Mutual Termination for Material Breach. If either party is in material breach of this agreement (including without limitation non-­‐
payment of any amounts owed Instructure), the other party may terminate this agreement at the end of a written 30-­‐day notice/cure period, if the breach has not been cured. c). Return or Destroy Upon Termination. Upon termination or expiration of this agreement for any reason, Customer must pay Instructure all amounts owed, and destroy or return all property of Instructure. Customer will confirm this destruction or return requirement in writing upon request of Instructure. d). Suspension of Service and Removal of Customer Content for Violations of Law or Policy. Instructure may immediately suspend the Service and remove applicable Customer Content if it in good faith believes that, as part of using the Service, Customer and/or its Users may have violated a law or a restriction in this agreement. Instructure may try to contact Customer in advance, but it is not required to do so. (8) GOVERNING LAW AND FORUM. This agreement is governed by the laws of the State of Utah, without regard to conflict of law principles. Any dispute arising out of or related to this agreement may only be brought in the state and federal courts for Salt Lake County, UT. Both parties consent to the personal jurisdiction of such courts and waive any claim that it is an inconvenient forum. Nothing in this agreement prevents either party from seeking injunctive relief in a court of competent jurisdiction. The prevailing party in any litigation is entitled to recover its attorneys’ fees and costs from the other party. The Convention on Contracts for the International Sale of Goods does not apply to this agreement. (9) INFRINGEMENT INDEMNITY. a). By Instructure. If a third-­‐party claims that the Service (other than related to any Customer Content) infringes that party's U.S patent, copyright or other proprietary right, Instructure will defend Customer against that claim at Instructure’s expense and pay all costs, damages, and attorney's fees, that a court finally awards or that are included in a settlement approved by Instructure, provided that Customer: i. promptly notifies Instructure in writing of the claim; and ii. allows Instructure to control, and cooperates with Instructure in, the defense and any related settlement. If such a claim is made, Instructure may continue to enable Customer to use the Service or to modify it such that it becomes non-­‐
infringing. If Instructure determines that these alternatives are not reasonably available, Instructure may terminate the Service without any liability to Customer upon notice to Customer and with the return of any prepaid and unused fees. The infringement indemnity obligations in this Section 9(a) does not apply to the extent the infringement claim arises from (a) any technology not provided by Instructure or otherwise identified by Instructure in writing as interoperable, (b) use of the Service other than in accordance with this agreement and the applicable Services documentation, (c) the Customer Content, and/or (d) modification or alteration to the Services by anyone other than Instructure. b). By Customer. If a third-­‐party makes a claim against Instructure that any part of the Customer Content infringes or violates a patent, trademark, trade secret, copyright or other intellectual property right, Customer will defend Instructure against that claim at Customer’s expense and pay all costs, damages, and attorney's fees, that a court finally awards or that are included in a settlement approved by Customer, provided that Instructure: i. promptly notifies Customer in writing of the claim; and ii. allows Customer to control, and cooperates with Customer in, the defense and any related settlement. (10) MISCELLANEOUS OTHER TERMS. Rev. 03.01.14 3 a). Money Damages Insufficient. Each party acknowledges and agrees that any threatened or actual breach by a party of this agreement or violation of the other party’s intellectual property rights could cause irreparable injury or harm to the other party for which monetary damages would be an inadequate remedy. In such case, the other party may seek a court order, without the requirement of posting bond, to stop any breach or avoid any future breach. b). Entire Agreement and Changes. This agreement and the corresponding orders constitute the entire agreement between the parties, and supersede all prior or contemporaneous negotiations, agreements and representations, whether oral or written, related to this subject matter. No modification or waiver of any term of this agreement is effective unless both parties sign it. c). Publicity. Customer agrees to act as a reference account that will, upon Instructure’s reasonable request, provide Service-­‐related comments to the press, potential investors, and current or prospective customers and participate in Service-­‐related case studies. Customer agrees to issue joint press releases with Instructure regarding the Service, as approved by Instructure. Customer agrees to allow Instructure to use its name, logo and non-­‐competitive use details in both text and pictures in its various marketing communications and materials, in accordance with Customer’s trademark guidelines and policies. d). No Assignment. Neither party may assign or transfer this agreement or an order to a third party, except that this agreement with all orders may be assigned as part of a merger, or sale of all or substantially all of the business or assets, of a party. e). Independent Contractors. The parties are independent contractors with respect to each other. f). Enforceability. If any term of this agreement is invalid or unenforceable, the other terms remain in effect and the invalid or unenforceable provision will be deemed modified so that it is valid and enforceable to the maximum extent permitted by law. g). No Additional Terms. Instructure rejects additional or conflicting terms of any Customer form-­‐purchasing document. h). Order of Precedence. If there is an inconsistency between this agreement and an order, the order prevails. i).
Survival of Terms. Any terms that by their nature survive termination or expiration of this agreement, will survive (including, but not limited to, Sections 4, 5, 6, and 9). j).
Notices. For purposes of service messages and notices about the Service, Instructure may place a banner notice or send an email to an email address associated with an account. It is the User’s responsibility to ensure that a current email address is associated with their account. k). Force Majeure. Any delay in the performance of any duties or obligations of either party (except the payment of money owed) will not be considered a breach of this agreement if such delay is caused by a labor dispute, shortage of materials, fire, earthquake, flood, or any other event beyond the control of such party. _____________________________________________(Customer) _____________________________________________ Signature _____________________________________________ Name _____________________________________________ Title _____________________________________________ Date _____________________________________________ Address Instructure, Inc. ______________________________________________ Signature ______________________________________________ Name ______________________________________________ Title ______________________________________________ Date 6330 South 3000 East, Suite 700 Salt Lake City, UT 84121
Rev. 03.01.14 4 State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Appendix C.
Disaster Recovery
Canvas’s Disaster Recovery Plan and Procedures is provided following this page.
11 September 2014
Instructure, Inc.
146
Instructure Engineering and Operations
Disaster Recovery Plan and
Procedures
Instructure, Inc.
17 January 2014
Disaster Recovery Plan and Procedures
Instructure Engineering and Operations
TABLE OF CONTENTS
1
Disaster Recovery Plan and Procedures ......................................................................................2
1.1
Policy and Practices..........................................................................................................2
1.1.1
Definition of Disaster ...................................................................................................2
1.1.2
Declaration of Disaster ................................................................................................2
1.2
Key Organizational Resources ..........................................................................................2
1.2.1
1.3
Disaster Recovery Team .............................................................................................2
Notification ........................................................................................................................3
1.3.1
Notifying Staff..............................................................................................................3
1.3.2
Notifying Clients and Business Partners......................................................................3
1.3.3
Testing ........................................................................................................................3
1.4
Disaster Recovery Solution ...............................................................................................3
1.4.1
Current Operating Infrastructure..................................................................................3
1.4.2
Objectives ...................................................................................................................4
1.4.3
Backup and Recovery Practices..................................................................................5
1.5
Sample Disaster Scenarios ...............................................................................................6
1.6
Complete Loss of a Master Database ...............................................................................6
1.7
Simultaneous Complete Loss of Master and Slave Databases ......................................... 6
1.8
Database Destruction by Hacker.......................................................................................6
1.9
Complete Loss of Primary Hosting Facility ........................................................................7
17 January 2014
Instructure, Inc.
i
Disaster Recovery Plan and Procedures
Instructure Engineering and Operations
1 DISASTER RECOVERY PLAN AND PROCEDURES
This document describes the plan and procedures that Instructure has established to recover
from disasters affecting its production operations. We describe how Canvas has been
architected to recover from disaster scenarios, the steps to be taken when disasters are
declared, the policies regarding notification of partners during disasters, and several example
scenarios and how they affect the service. Our disaster recovery procedures address events
which would affect an entire facility. Failures of individual components are recovered through
architectural redundancies and fail-over mechanisms.
1.1
Policy and Practices
1.1.1
Definition of Disaster
A disaster is defined as any disruptive event that has potentially long-term adverse effects on
the Instructure service. In general, potential disaster events will be addressed with the highest
priority at all levels at Instructure. Such events can be intentional or unintentional, as follows:
•
Natural disasters: Tornado, earthquake, hurricane, fire, landslide, flood, electrical
storm, and tsunami.
•
Supply systems: Utility failures such as severed gas or water lines, communication line
failures, electrical power outages/surges, and energy shortage.
•
Human-made/political: Terrorism, theft, disgruntled worker, arson, labor strike,
sabotage, riots, vandalism, virus, and hacker attacks.
1.1.2
Declaration of Disaster
All potential disasters will be escalated immediately to the Director of Operations. The Director
of Operations is responsible for assessing the event and confirming the disaster. Once the
disaster is declared, the Director of Operations is responsible for directing recovery efforts and
notifications.
1.2
Key Organizational Resources
1.2.1
Disaster Recovery Team
The Disaster Recovery Team (DRT) is made up of key engineers and operations employees.
The responsibilities of the DRT include:
•
Establish communication between the individuals necessary to execute recovery
•
Determine steps necessary to recover completely from the disaster
•
Execute the recovery steps
•
Verify that recovery is complete
17 Jaunary 2014
6330 South 3000 East, Salt Lake City, UT 84121 • 800.203.6755
2
Disaster Recovery Plan and Procedures
Instructure Engineering and Operations
•
1.3
Inform the Director of Operations of completion
Notification
There are several parties that must be notified at various stages during disaster events.
1.3.1
Notifying Staff
The Director of Operations is responsible for making sure the DRT and any other necessary
staff are notified of a disaster event and mobilized. Notification of staff will generally happen via
cell phone.
1.3.2
Notifying Clients and Business Partners
Clients and business partners will be notified at various stages of disaster recovery by the
Director of Operations via email. If email is unavailable, notification will happen via alternative
methods (cell phone, etc.) according to the agreements established with each client institution.
The stages of notification are:
•
Disaster Declaration: When a disaster is declared the notification will include a
description of the event, the effect to the service, and any potential impact to data.
•
Completion of Recovery: Once recovery is complete and the service is available, the
notification will include general information about steps taken to recovery, and any data
that may have been impacted. If the recovery is partial and the service is still in a
degraded state, this notification will include an estimate of how long the degradation will
continue.
1.3.3
Testing
A Disaster Recovery Plan is only useful insofar as it is tested regularly. The Director of
Operations is responsible for ensuring that the plan is tested in its entirety at least annually and
in part whenever major components are changed.
1.4
1.4.1
Disaster Recovery Solution
Current Operating Infrastructure
Canvas is based on a multi-tier cloud-based architecture. Each component is redundant with
active monitoring for failure detection and failover. The different tiers are:
1.4.1.1
Load Balancers
All web traffic to .instructure.com is served by two load balancers in an active/passive
configuration. The load balancers are responsible for directing traffic to the next tier.
17 Jaunary 2014
Instructure, Inc.
3
Disaster Recovery Plan and Procedures
Instructure Engineering and Operations
1.4.1.2
App Servers
App servers process incoming requests from clients from the load balancers. App servers
implement all the business logic, but do not persist any important data. Asynchronous jobs also
run on the app servers. The number of app servers varies based on demand, but will always be
at least two in active/active configurations.
1.4.1.3
Caching
To improve website performance, Canvas aggressively caches data in a caching layer. The
data stored here is strictly a performance cache. Any data loss resulting from the loss of any of
these servers would be limited toa small number of page views that may not have been flushed
to persistent storage. The number of cache servers is variable and the cache data will be
partitioned among all servers.
1.4.1.4
Databases
Most structured data—courses, user information, and assignments, for example—is stored in a
databases. This data is sharded between instances based on account and on demand. Each
shard has a Master and a Slave database, located in geographically separate sites. The data
from each Master is replicated asynchronously in near real-time to its corresponding Slave.
Each Master is also backed up completely every 24 hours, and the backup is stored in a third
geographically separate site. The infrastructure also includes an internal database proxy layer
for the relational databases that enables the Operations team to perform maintenance on the
relational database servers with mimimal downtime.
1.4.1.5
Third-Party Object Store
Content—such as documents, PDFs, audio, and video—is stored in a third-party scalable object
store.
1.4.2
Objectives
In the context of a disaster recovery scenario, there are two terms which are commonly used to
describe how the data may be affected: Recovery Time Objective (RTO) and Recovery Point
Objective (RPO). The RTO is how long it will take to make access to the data available again,
and the RPO is how much of the most recent data will be preserved. For example, if it takes 12
hours for a service to recover, but on a failure up to 24 hours of data may be lost, the RTO is 12
hours and the RPO is 24 hours.
The Canvas platform has been architected to achieve an exceptionally low RPO and RTO in the
common case. The goal for a disaster scenario for both RPO and RTO is 24 hours. This 24hour RPO and RTO, as well as other RPO and RTO estimates provided in this plan, are
17 Jaunary 2014
6330 South 3000 East, Salt Lake City, UT 84121 • 800.203.6755
4
Disaster Recovery Plan and Procedures
Instructure Engineering and Operations
extremely conservative upper-end estimates. In actual practice, the Operations team expects
much lower RPO and RTO times.
1.4.3
Backup and Recovery Practices
The Operations team keeps a skeleton infrastructure running in disaster recovery regions which
is ramped up for scale, a process normally performed every morning as load increases. Backup
and recovery practices for specific assets are described below.
Instructor, student, course, assignment data from database
Backup
Data is replicated asynchronously in near real-time to remote site (monitored, etc.).
Nightly backups of every database are stored in third remote site.
Recovery
When slave is caught up:
• Promote slave database to master, following replication docs
• Provision new database using provisioning tools
• Establish new database as new slave, following replication docs
When slave is > 24 hours behind
• Copy last nightly backup to slave database
• Load slave with nightly backup
• Provision new database using provisioning tools
• Establish new database as new slave, following replication docs
Static assets from courses and assignments such as documents and other content files
Backup
Files are stored on a scalable, protected, geographically redundant storage system
(Amazon S3).
Multiple copies are stored by Instructure which provide the backups.
Recovery
Recovery in case of failures is built into the scalable storage system.
Web applications
Backup
Web application source code is stored in versioned source control and backed up to
multiple locations.
There is no state stored on the application servers that would need to be backed up.
Recovery
17 Jaunary 2014
Not applicable.
Instructure, Inc.
5
Disaster Recovery Plan and Procedures
Instructure Engineering and Operations
1.5
Sample Disaster Scenarios
Following are several different possible disaster scenarios and their RPO/RTO, services
affected, and recovery overview. Note that these are intended only to convey magnitude of
impact and recovery efforts required under different situations.
1.6
Complete Loss of a Master Database
Services Affected
Recovery Overview
Most accounts hosted on the affected database.
• When the slave database is up-to-date (common case): The slave is
promoted to be the new master according to the steps described above.
• When the slave database is inconsistent: The slave is populated with the
latest nightly snapshot and brought online as the new master.
RPO
5 minutes (consistent slave, common case), 24 hours (inconsistent slave)
RTO
1 hour (consistent slave, common case), 6 hours (inconsistent slave)
Likelihood
Once a year
1.7
Simultaneous Complete Loss of Master and Slave Databases
Services Affected
Recovery Overview
Most accounts hosted on the affected database.
• New master and slave databases are brought online in separate locations.
• The master database is populated with data from the offsite backup.
• App servers pointed to new master database.
• Replication re-established with the new slave database.
RPO
24 hours
RTO
6 hours
Likelihood
Once every 20 years (the master and slave databases are hosted in
geographically separate locations, which makes simultaneous failure very
unlikely)
1.8
Database Destruction by Hacker
Services Affected
Recovery Overview
Most accounts hosted on the affected database.
• The master database is restored from the most recent complete backup.
• Replication is re-established with the slave database.
RPO
17 Jaunary 2014
24 hours
6330 South 3000 East, Salt Lake City, UT 84121 • 800.203.6755
6
Disaster Recovery Plan and Procedures
Instructure Engineering and Operations
RTO
6 hours
Likelihood
Once every 10 years
1.9
Complete Loss of Primary Hosting Facility
Services Affected
Recovery Overview
LMS for most accounts.
• New load balancers and app servers are brought up in the secondary site
with the slave database.
• The old slave database is promoted to master database.
• A new database slave is brought up at a third site and replication reestablished.
• DNS is pointed to the new load balancers at the recovery site and services
are restored.
RPO
4 hours
RTO
24 hours
Likelihood
Once every 10 years
17 Jaunary 2014
Instructure, Inc.
7
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Appendix D.
Canvas Security
The Instructure Security, Engineering, and Operations document is provided following this cover
page.
11 September 2014
Instructure, Inc.
147
Instructure Security, Engineering, and Operations
Canvas Security
Instructure, Inc.
6 May 2014
Canvas Security
Instructure Security, Engineering, and Operations
TABLE OF CONTENTS
1
2
3
4
5
Canvas Security Infrastructure .............................................................................................3
1.1
AWS Network Security .............................................................................................3
1.2
AWS Services ..........................................................................................................4
1.3
AWS Regions and Data Centers ..............................................................................4
1.4
AWS Data Security ..................................................................................................4
Canvas System Security ......................................................................................................5
2.1
Identity and Access Management.............................................................................5
2.2
Protocol and Session Security..................................................................................5
2.3
Preventing Cross-Site Scripting (XSS) Attacks .........................................................6
2.4
File Upload and Download Security..........................................................................6
2.5
Data Security............................................................................................................7
2.6
Database Connection Security .................................................................................7
2.7
Data Security through Redundancy and Versioning .................................................7
2.7.1
Canvas Disaster Recovery ...................................................................................... 7
Canvas Security Audits ........................................................................................................9
3.1
Internal Security Audits ............................................................................................9
3.2
External Security Audits ...........................................................................................9
Instructure Internal Security ...............................................................................................11
4.1
System and Data Access Policy .............................................................................11
4.1.1
Cryptographic Keys ................................................................................................11
4.1.2
Physical Security ....................................................................................................11
4.1.3
Secure Coding and Development Practices ...........................................................12
4.1.4
Testing and Quality Assurance ...............................................................................12
4.2
Instructure's Response to Security Alerts ...............................................................12
Data Exposure Response Policy and Plan .........................................................................14
5.1
Data Exposure Response Policy ............................................................................14
5.2
Data Exposure Response Plan ..............................................................................14
5.2.1
Determine the Scope of the Security Breach ..........................................................14
5.2.2
Assemble an Incident Response Team ..................................................................15
5.2.3
Control Dissemination of Information......................................................................15
6 May 2014
Instructure, Inc.
1
Canvas Security
Instructure Security, Engineering, and Operations
6
5.2.4
Alert Administrative Team ......................................................................................15
5.2.5
Identify Affected Persons .......................................................................................15
5.2.6
Notify Affected Persons ..........................................................................................15
5.2.7
Manage the Incident Resolution and Aftermath ......................................................15
FERPA Compliance ...........................................................................................................16
6.1
FERPA Overview ...................................................................................................16
6.2
Customization ........................................................................................................18
6.3
Permissions ...........................................................................................................18
6.4
Course Settings......................................................................................................19
6.5
Account Settings ....................................................................................................21
6.5.1
Authentication Integration .......................................................................................21
6.5.2
Assessment Results in External Notifications .........................................................21
6.6
Other Default FERPA-related Features ..................................................................22
6 May 2014
Instructure, Inc.
2
Canvas Security
Instructure Security, Engineering, and Operations
1
CANVAS SECURITY INFRASTRUCTURE
The Canvas education technology platform and learning management system is hosted on the
state-of-the-technology cloud infrastructure provided by Amazon Web Services (AWS). The
AWS infrastructure is highly stable, fault-tolerant, and secure as attested by the following
certifications:
•
Statement on Auditing Standards No. 70 (SAS 70) Type II audited
•
Service Organization Controls 1 (SOC 1) reported and published under both the
Statement on Standards for Attestation Engagements 16 (SSAE 16) and the
International Standard on Assurance Engagements 3402 (ISAE 3402) standards
•
Certified ISO/IEC 27001:2005 Information technology – Security techniques –
Information security management systems – Requirements
•
Level 1 service provider under the Payment Card Industry (PCI) Data Security Standard
(DSS)
•
Federal Information Security Management Act (FISMA) Moderate Authorization and
Accreditation received from the U.S. General Services Administration.
For additional information about AWS security certifications and standards compliance, please
refer to http://aws.amazon.com/security and http://aws.amazon.com/compliance/.
1.1
AWS Network Security
The AWS cloud infrastructure provides extensive network and security monitoring systems to
protect the Canvas production environment and its data. These systems protect against:
•
Distributed Denial Of Service (DDoS) Attacks. Proprietary DDoS mitigation
techniques are used. Additionally, AWS’s networks are multi-homed across a number of
providers to achieve Internet access diversity.
•
Man In the Middle (MITM) Attacks. All of the AWS APIs are available via SSLprotected endpoints which provide server authentication. Amazon Elastic Compute
Cloud (EC2) Amazon Machine Images (AMIs) automatically generate new Secure Shell
(SSH) host certificates on first boot and log them to the instance’s console.
•
IP Spoofing. Amazon EC2 instances cannot send spoofed network traffic. The AWScontrolled, host-based firewall infrastructure will not permit an instance to send traffic
with a source IP or MAC address other than its own.
•
Port Scanning. When port scanning is detected, it is stopped and blocked.
6 May 2014
Instructure, Inc.
3
Canvas Security
Instructure Security, Engineering, and Operations
1.2
AWS Services
The AWS services used to host Canvas include Elastic Compute Cloud (EC2), Elastic Load
Balancing (ELB), Simple Storage System (S3), Elastic Block Store (EBS), Virtual Private Cloud
(VPC), Simple Email Service (SES), CloudFront, Identity and Access Management (IAM),
DirectConnect, and CloudSearch. All Canvas application nodes are hosted on the Amazon EC2
and S3 infrastructure, making full use of the real-time redundancy and capacity capabilities.
Virtualization is provided by Amazon EC2.
1.3
AWS Regions and Data Centers
Amazon EC2 is hosted in multiple locations world-wide. These locations comprise regions and
Availability Zones. Each region is a separate geographic area and each region has multiple,
isolated locations known as Availability Zones. Instructure uses three AWS regions: the US East
(Northern Virginia) Region with 5 EC2 Availability Zones, the US West (Oregon) Region with 3
EC2 Availability Zones, and the AWS EU West (Ireland) Region with 3 EC2 Availability Zones.
AWS data centers utilize state-of-the-art electronic surveillance and multi-factor access control
systems. Data centers are staffed 24x7 by trained security guards and access is authorized
strictly on a least privileged basis. Environmental systems are designed to minimize the impact
of disruptions to operations. Multiple geographic regions and Availability Zones provide
resilience in the face of most failure modes including natural disasters or system failures.
AWS data center electrical power systems are designed to be fully redundant and maintainable
without impact to operations, 24 hours a day, and seven days a week. Uninterruptible Power
Supply (UPS) units provide back-up power in the event of an electrical failure for critical and
essential loads in the facility. Generators provide back-up power for the data centers of the
entire facility.
1.4
AWS Data Security
All data traffic in and out of Canvas is at least 128-bit TLS/SSL-encrypted over HTTPS
connections. Data is stored redundantly in the Amazon S3 infrastructure across and multiple
geographic regions and multiple data centers. Canvas data is replicated in near real-time on the
Amazon S3 infrastructure and is also backed up on a daily basis to geographically separate
locations. Daily backups of Canvas data include media, file system data, course structures,
coursework, analytics, rubrics, learning outcomes, and metadata. Canvas data replication and
backups ensure that, in the event of a necessary system restore, the potential data loss would
be limited to no more than ten minutes of data.
6 May 2014
Instructure, Inc.
4
Canvas Security
Instructure Security, Engineering, and Operations
2
CANVAS SYSTEM SECURITY
Canvas has been designed to achieve a high level of security by providing an uncomplicated,
usable approach to user authentication, system access, and role-based, hierarchical
permissions. Canvas is designed to support institution’s own internal security policies and to
provide rigorous protection from internal or external intrusions. Canvas reinforces system
security by presenting a simple security model to end-users because research shows that if
users have to jump through too many security hoops, they will attempt to find ways to bypass
security entirely.
2.1
Identity and Access Management
Canvas supports centralized identity management and delegated authentication via integrations
with external identity providers (IdPs) including Lightweight Directory Access Protocol (LDAP),
Active Directory, Central Authentication Service (CAS), Security Assertion Markup Language
(SAML) 2.0, and Shibboleth. Canvas supports federated identity management and Single SignOn (SSO) via integrations with SAML, Shibboleth, and CAS. Additionally, user ID and password
credentials from any third-party system can be synchronized with Canvas-internal, local
authentication via the Canvas open API.
Canvas-internal authentication can be used alone or concurrently with any of the supported
external IdPs identified above. For example, when used concurrently with LDAP, Canvas first
presents user credentials to the external IdP. If authentication fails, Canvas then looks up the
credentials using its internal authentication service. If authentication fails again, Canvas will
deny the user login.
Canvas clients are encouraged to use Canvas in concert with their preferred external idP in
order to best control and establish end-user security protocols. For Canvas-internal
authentication, passwords must be 6 or more characters. Passwords are never stored in plain
text. Passwords are securely hashed via the SHA-512 cryptographic hash algorithm with a
randomly generated "salt" value. The resulting signature and salt value are then stored. When
users attempt to authenticate, their credentials are passed through the same process and the
resulting signature is checked against the stored signature. This process is exclusively unidirectional and passwords cannot be derived from their stored signature.
2.2
Protocol and Session Security
Canvas uses HTTPS (HTTP over TLS/SSL) for all communication. All inbound and outbound
traffic is encrypted using 128-bit TLS/SSL ensuring that all personally-identifiable information,
credentials exchange, page requests, and session data are secure.
Sessions are maintained and can be invalidated in the Canvas infrastructure. An encrypted
session cookie, signed with a hash message authentication code (HMAC), is used only identify
6 May 2014
Instructure, Inc.
5
Canvas Security
Instructure Security, Engineering, and Operations
a current session. The HMAC and cookie contents are encrypted with Advanced Encryption
Standard (AES)-256 in cipher feedback (CFB) mode. The contents of the cookie cannot
hijacked during transmission across the network, cannot be viewed or tampered with by the
user, and cannot be accessed through javascript. Session IDs are compared and validated
against the server-stored values. An invalidated session will require a user to login again.
Sessions are reset on each successful login to prevent access to session IDs by subsequent
logins. To prevent cross-site request forgery (CSRF) vulnerabilities, all user actions that modify
data require a session secret key to post data. All requests that modify data are done with
HTTPS POST or PUT requests, never GETs.
2.3
Preventing Cross-Site Scripting (XSS) Attacks
Canvas employs a variety of strategies to prevent cross-site scripting (XSS) attacks. For
example, when Canvas creates a form for user input, a one-time use token is embedded in the
HTML form so that Canvas can identify the form and verify that it did not originate another site in
a possible attack attempt.
As another example, because user-supplied JavaScript present a critical security vulnerability,
Canvas does not allow non-administrative users to embed JavaScript directly into any Canvas
pages. If, for example, a student were able to add JavaScript to a page, the student could
embed code that changes the student’s grade when the instructor visits the page without the
instructor detecting it. For this reason, only Canvas account administrators can add custom
JavaScript.
Canvas sanitizes content to protect against intentional or unintentional vulnerabilities. When
content is put into a Canvas form, such as content that a user enters with the Rich Content
Editor, Canvas scrubs the content and removes any of malicious content. Content sanitization
prevents session jacking, form hacks, and other unauthorized data access and/or modifications.
All user-inputted content is sanitized server-side—not in JavaScript which can be bypassed—
before it is saved to the database. The sanitization is done by explicit whitelisting, not
blacklisting. This prevents the addition of JavaScript to HTML data and prevent the addition of
the unsafe HTML tags as well.
2.4
File Upload and Download Security
User-uploaded files are stored in the Amazon S3 infrastructure with unique names and folders.
To prevent side-jacking from user uploaded files and preserve the integrity of the system,
Canvas places uploaded files in the Files repository under a different subdomain to establish a
separate security domain in order to take advantage of the browser’s same-origin security
measures. The browser will enforce security between the uploaded files and the user’s session
and prevent session jacking. If an uploaded file executes code using JavaScript, Java, Flash, or
6 May 2014
Instructure, Inc.
6
Canvas Security
Instructure Security, Engineering, and Operations
other technologies, that code will not be able to access the user's session nor be able to make
requests to Canvas on the user's behalf.
All file downloads require unique, short-lived authorization keys.
2.5
Data Security
Instructure has developed custom code to validate that all Canvas data models are protected
against invalid assignment. For example, no user can change foreign keys arbitrarily and all
lookups are scoped to the appropriate current user and context. All SQL is built using
placeholders and a framework for escaping user input; strings are never directly interpolated or
concatenated.
The Canvas API provides secure access to Canvas data and functionality while preventing
direct access to Canvas databases. The Canvas API uses the industry-standard OAuth2
protocol which allows third-party applications to access data and perform actions on behalf of
users without ever having possession of the user's password. Users that use the API can
revoke access to specific applications at any time.
2.6
Database Connection Security
Application servers communicate with the database via a "bouncer," a database proxy that
handles connection pooling. Connections between the application servers and the bouncer as
well as between the bouncer and the databases are over a heavily firewalled virtual network.
The protocol spoken is the PostgreSQL secure TCP/IP with TLS/SSL protocol.
2.7
Data Security through Redundancy and Versioning
To protect against malicious or accidental data destruction, Canvas stores data redundantly and
employs soft-deletions. Administrators and instructors can recover previous versions of the
gradebook, content pages, and assignment submissions.
Instructure maintains versions of all Canvas data and content by taking a series of periodic
snapshots of databases. Snapshots of databases are taken daily and each daily snapshot is
retained for a week. Weekly snapshots are taken and retained for a month. Monthly snapshots
are taken and retained for a year.
2.7.1 Canvas Disaster Recovery
Most structured data—courses, user information, and assignments—is stored in a PostgreSQL
database. This data is horizontally partitioned between instances based on account and
demand. Each partition has a primary and a secondary or replica database, located in
geographically separate sites. The data from each primary is replicated asynchronously in near-
6 May 2014
Instructure, Inc.
7
Canvas Security
Instructure Security, Engineering, and Operations
real time to its corresponding secondary. Each primary is also backed up completely every 24
hours, and the backup is stored in a third geographically separate site.
Files for static assets from courses and assignments are stored on a scalable, protected,
geographically redundant storage system of the Amazon S3 infrastructure. Multiple copies are
stored by Instructure for backup.
6 May 2014
Instructure, Inc.
8
Canvas Security
Instructure Security, Engineering, and Operations
3
CANVAS SECURITY AUDITS
3.1
Internal Security Audits
Instructure’s security team conducts quarterly internal security audits of the Canvas code base
and Instructure’s production environment. Members of Instructure’s security team have many
years of experience with security audits by major corporations and government agencies. Audit
policies and procedures are reviewed on a regular basis and updated as needed by the security
team.
The Instructure security team conducts thorough, comprehensive, prescriptive, internal security
audits at least once a quarter. In these quarterly audits, the security team:
•
Uses different development teams to do both Black Box and White Box testing.
o
In Black Box testing, developers presume no prior knowledge of the code or the
inner workings of the application and then attempt to discover and exploit
security vulnerabilities by a variety of methods. Black Box testing requires
developers to think like a hacker. "How would I break into this system? How
would I steal this data?"
o
In White Box testing, developers use their prior knowledge of the code and the
inner workings of the application to test methods that could be exploited
externally too. Developer reads through the application source code, looking for
vulnerabilities at a low level.
•
Attacks the application externally, using both off-the-shelf and custom internally-built
tools.
•
Documents potential vulnerabilities, recommends fixes, and implements the most
advantageous fix. The fixes are then retested, by both the original discoverer(s) and
other, new-to-the-problem team members.
•
Pushes fixes made in external libraries to the upstream development activities to be
immediately applied and included in official packages instead of waiting for the next
scheduled Canvas update release.
Instructure encourages all clients to subscribe the Canvas Security Advisory Forum at
http://help.instructure.com/forums/20382721-security-notices where security notices from
internal security reviews, scanning, and testing are published.
3.2
External Security Audits
In addition to our frequent internal security audits conducted throughout the year, Instructure
conducts annual, open, third-party security reviews. The 2012 review was conducted by the
6 May 2014
Instructure, Inc.
9
Canvas Security
Instructure Security, Engineering, and Operations
security company, Securus Global, in December 2012 and the results are available at
http://www.instructure.com/downloads/Instructure_Canvas_Security_Summary_2012.pdf.
The open, external security audit is one way that Instructure can demonstrate not only the state
of Canvas security, but also our responsiveness to any vulnerabilities. For example, in that
audit, Securus Global identified three high-risk vulnerabilities in Canvas itself and in the
underlying libraries Canvas uses. Instructure fixed those vulnerabilities on the same day that
Securus Global reported them and Instructure issued security bulletins to our customers. And
because Canvas is a true multi-tenant application, Canvas clients never experience the adverse
effects due to unapplied updates or patches due to version differences or added costs or wait
times for service packs.
This same level of responsiveness is applied when Instructure receives external input on
security outside of the formal audit process. For example, in January 2013, a Rails SQL security
vulnerability was identified. Instructure patched this vulnerability within a couple of hours with no
downtime. Instructure Engineering also provided the updates Canvas source code on Github at
the same time. Additional details are available on the Instructure Security Advisory Forum at:
http://help.instructure.com/entries/21563740-instructure-advisory-iac56413-rails-sql-injectionvulnerability.
In addition, because Canvas is open source, anyone may audit the Canvas code at anytime.
Multiple institutions and other entities have conducted their own independent security audits of
the code. If and when security defects or vulnerabilities are discovered, Instructure’s engineers
work closely with these parties to resolve any discovered flaws. For customers who are
interested in conducting their own security audit of Canvas, Instructure will, upon request, set up
an environment, where they can conduct automated and manual vulnerability scanning.
6 May 2014
Instructure, Inc.
10
Canvas Security
Instructure Security, Engineering, and Operations
4
INSTRUCTURE INTERNAL SECURITY
Instructure uses commercially reasonable efforts to provide logical and physical security
designed to maintain the integrity of the logical and physical security of its internal systems and
customer data and content.
4.1
System and Data Access Policy
Instructure uses a multiple approval system for granting access to employees. First, the
manager of the employee requesting access must fill out a ticket requesting detailed level of
access to the system and specifying which parts, functions, and features are to be accessible by
the employee. Clear, valid, and necessary business justification must be provided for the user in
question.
The completed access request ticket is then routed to the Director of Operations. If approved by
the Director of Operations, the request ticket is routed to the Operations team for final approval.
If all parties approve the employee’s access, the Operations team grants access as requested
in the ticket. Per the employee exit policy, user accounts are deleted upon termination of
employment.
All on-boarded Instructure employees are required to read, understand, and sign Family
Educational Rights and Privacy Act (FERPA) and Children's Online Privacy Protection Act
(COPPA) compliance forms.
4.1.1 Cryptographic Keys
Instructure’s Operations team controls generation and installation of keys for all employees with
access to the servers. An automated configuration system (Puppet) installs employee public
keys on a per-server basis based on need. This same configuration process automatically
revokes keys globally when necessary. Employees are required to use full-disk encryption and
password protection on their work machines to protect their private keys and other sensitive
data. The private keys used for HTTPS are stored encrypted and decrypted by operations when
deployed to the application servers.
Monitoring and alerts are in place to detect and warn of any changes to keys, users on the
system, login and sudo attempts, and other events of concern.
4.1.2 Physical Security
Access to Instructure’s offices is controlled using access cards. Instructure restricts access to
internal servers by physical locks. Instructure uses commercially reasonable efforts to protect
client data behind a secure firewall system, to conduct daily data backups, and to store weekly
full-system backups in a separate, fire-resistant facility.
6 May 2014
Instructure, Inc.
11
Canvas Security
Instructure Security, Engineering, and Operations
4.1.3 Secure Coding and Development Practices
Maintaining and enhancing security is a disciplined, continual, and ongoing process. Secure
coding and security testing are, therefore, integral components of Instructure’s engineering and
development methodology. All code in the application must go through a developer peer review
process before it is merged into the code base repository. The code review includes security
auditing are based on the Open Web Application Security Project (OWASP) secure coding and
code review documents and other community sources on best security practices.
All Canvas developers are trained to identify and analyze security issues when writing and
reviewing code. Members of the core security team and the engineering team subscribe to
security-focused lists, blogs, and other resources to maintain, expand, and share the collective
body of knowledge. Instructure maintains an internal wiki to discuss and share best practices for
the mitigation and prevention of security pitfalls and vulnerabilities. The security and engineering
teams keep up-to-date on general security practices, on recent attack vectors, and on any
security issues specifically related to the languages, web applications, frameworks, and
environments that Instructure employs to develop, host, and maintain Canvas.
Peer reviews of all source code changes are mandatory. Multiple peer reviews are conducted
for each change to the Canvas code base to detect and correct any bugs, security flaws, and
any other code defects. Changes to Canvas code must be validated by peer review before the
code is approved and committed to the code base repository.
4.1.4 Testing and Quality Assurance
Once new code has passed peer review, the code is incorporated into the code base and
submitted to testing and quality assurance. The new code is deployed to a continuous
integration server where it is immediately tested. Instructure’s testing team runs:
•
Unit tests (testing code with code)
•
Integration tests (testing code with integrations with other code)
•
Selenium tests (testing how code works in the browser) on all the different environments
and across different databases.
After passing these tests, the code is incorporated in the main Canvas development code for
formal quality assurance (QA). The QA team tests the new code on all supported platforms and
browsers.
4.2
Instructure's Response to Security Alerts
Unlike traditional LMS licensed products with service packs which often do not address security
problems for weeks or months and which must be applied by the users themselves, Canvas is a
cloud service with a single version of the code base and production environment so that security
6 May 2014
Instructure, Inc.
12
Canvas Security
Instructure Security, Engineering, and Operations
updates are immediately and automatically applied for the entire client base as part of
Instructure’s hosting services.
Regular vulnerability scans of the Canvas application and infrastructure are conducted using
third-party tools (for example, Burp Suite Pro), custom scripts, and open source tools. If any
vulnerabilities are detected, Instructure’s security and engineering teams work together to
analyze, design, and develop the required patch. Security-related patches to the operating
system, application software, and libraries are applied within one (1) week except in those
cases which have been determined to be high severity. If a high-severity security vulnerability is
detected, fixing the vulnerability is given the highest priority by Instructure’s security and
engineering teams. High-severity security patches will be applied within twenty-four (24) hours
by best commercial efforts. In most cases, the vulnerability can be fixed using a hot patch
without incurring any downtime to the Canvas production environment.
Instructure, in coordination with AWS, takes a proactive approach to enforcing SAS 70 Type II
controls. Postmortems are convened after any significant operational issue, regardless of
external impact, and Cause of Error (COE) documents are drafted so the root cause is captured
and preventative actions are taken in the future. Implementation of the preventative measures is
tracked during Instructure’s weekly operations meetings.
6 May 2014
Instructure, Inc.
13
Canvas Security
Instructure Security, Engineering, and Operations
5 DATA EXPOSURE RESPONSE POLICY AND PLAN
Data security and safeguarding users’ privacy are paramount concerns of Instructure.
Instructure has implemented a comprehensive set of security technologies, management and
review policies, monitoring operations, and enforcement procedures to ensure that our system
and data security meets or exceeds governmental statutes and regulations, industry standards,
and institutional requirements.
5.1
Data Exposure Response Policy
Backing up these preventative measures, Instructure has established a set of prescriptive
responses to be executed in the event of unauthorized data exposure. Data exposure occurs
when restricted or confidential information is disclosed, exposed, or reasonably believed to have
been disclosed or exposed to an unauthorized person, process, or system.
Instructure’s data exposure policy has been designed to ensure:
5.2
•
Earliest possible detection of a system or data security breach;
•
Rapid securing of the system and data to prevent further unauthorized exposure;
•
Responsive notification to users and other affected parties that confidential or personal
information has been or may have been exposed or compromised by a breach in system
security.
Data Exposure Response Plan
In the event of a breach of security and potential unauthorized data exposure, the information
security officer will oversee and execute a plan of action that conforms to the guidelines
described in the subsections below. The exact plan of action to be executed and the sequence
of the actions taken will depend on the type and scope of the breach in security.
5.2.1 Determine the Scope of the Security Breach
In all cases, the information security officer and staff will quickly assess the status of the breach
to determine whether the activity is ongoing. If the activity is ongoing, the security staff will take
immediate requisite measures to stop the unauthorized activity in order to prevent any further
data loss. Once the breach is isolated and stopped, the information security officer and staff will
begin to ascertain the extent of the breach, the source and type of data involved, the amount of
data, and the affected persons and system resources.
6 May 2014
Instructure, Inc.
14
Canvas Security
Instructure Security, Engineering, and Operations
5.2.2 Assemble an Incident Response Team
The information security officer will assemble an incident response team. The composition and
charge of the team will depend upon the type of breach and resulting data exposure. The team
will conduct a preliminary assessment and risk assessment and help develop a tailored incident
response plan. Once the incident is contained, this team will also evaluate changes in
processes, systems and/or policies to prevent a repeat event.
5.2.3 Control Dissemination of Information
In order to ensure that only accurate, timely information that will not interfere with the ongoing
investigation is released, only the information security officer will be authorized to provide
information to any party outside of the incident response team.
5.2.4 Alert Administrative Team
The information security officer will alert the appropriate senior administrators including the
Instructure executive team, client institution officials, system engineers, and other key players
as warranted.
5.2.5 Identify Affected Persons
The information security officer will work with institution officials, Instructure’s VP of Engineering,
Instructure’s Director of Operations, and the incident response team to determine the identities
of affected individuals and determine the extent of the data exposure.
5.2.6 Notify Affected Persons
The information security officer will work with the VP of Engineering, Legal, Director of
Operations, and the incident response team to draft and execute a notification plan. The
purpose of the plan is to provide full, accurate, and timely notification that meets or exceeds all
statutory requirements. In the case of high severity security issues, affected parties will be
alerted immediately while indirectly affected parties will be alerted within twenty-four (24) hours.
These legal requirements will vary on a state-by-state basis. Working with the appropriate
parties, The information security officer and the incident response team notify all affected
individuals and develop remediation strategies as appropriate and sufficient to the situation.
5.2.7 Manage the Incident Resolution and Aftermath
The information security officer and the incident response team will continue to update and
communicate response status, determine next steps, and develop a postmortem plan to review
the efficiency and effectiveness of the response and develop future prevention and/or mitigation
processes and procedures.
6 May 2014
Instructure, Inc.
15
Canvas Security
Instructure Security, Engineering, and Operations
6 FERPA COMPLIANCE
Canvas was built to comply with the Family Educational Rights and Privacy Act (FERPA) by
design and Canvas readily integrates with other campus systems to prevent unauthorized
access to FERPA-protected data. Whether implemented as a standalone system or as a fully
integrated component of the campus IT/IS infrastructure, Canvas provides educational
institutions and agencies with multiple mechanisms and technologies to manage, enforce, and
comply with the provisions of FERPA and to fulfill their responsibilities under its requirements.
6.1
FERPA Overview
FERPA is a Federal law that protects the privacy of student education records. The law applies
to all schools and institutions that receive funds under the applicable program of the U.S.
Department of Education. FERPA provides students, and in some instances parents, the right to
inspect their education records and some ability to control the disclosure of information
contained in their education records. 1
FERPA requires educational agencies, which disclose personally identifiable information from a
student’s education record to other school officials, to use “reasonable methods” to insure
school officials obtain access to only the education records they have legitimate educational
interests in. 2
Table 6–1 identifies key sections and requirements of the Family Educational Rights and
Privacy Act (FERPA) and briefly describes how Instructure and the Canvas learning
management system (LMS) comply.
Table 6–1. Key FERPA Requirements and Instructure and Canvas Compliance
Item
Instructure as a
“School Official”
FERPA Section
34 CFR§ 99.31
(1)(i)(B)
Requirements
(1) Performs an institutional service
or function for which the agency or
institution would otherwise use
employees; and(2) Under the direct
control of the agency or institution
with respect to the use and
maintenance of education records;
and(3) Is subject to the requirements
of § 99.33(a) governing the use and
redisclosure of personally identifiable
information from education records.
Comments
Instructure is under the direct
contractual control by the
agency or institution with
respect to the use and
maintenance of education
records.
1
http://www2.ed.gov/policy/gen/guid/fpco/ferpa/index.html
34 CFR § 99.31
2
6 May 2014
Instructure, Inc.
16
Canvas Security
Instructure Security, Engineering, and Operations
Item
FERPA Section
Agency or
Institution
Disclosure to
Instructure as a
“School Official”
34 CFR § 99.31
(a)(ii)
Requirement of
Further NonDisclosure
Requirements
Comments
Education institution must use
“reasonable methods” to make sure
school officials have access to only
education records they have
legitimate educational interests in.
Provide Instructure only the
information needed to serve its
function.
34 CFR § 99.33
(a)(1)
School can disclose information only
on the condition that the party to
whom the information is disclosed will
not disclose the information to any
other party without the prior consent
of the parent or eligible student.
Contract with Instructure
specifies that Instructure not
disclose the information to any
other party and otherwise in
compliance with FERPA.
Permission settings
within the Software
34 CFR § 99.30
(a)
Parent or eligible student shall
provide a signed & dated written
consent before an educational
agency or institution discloses
personally identifiable information
from the student’s educational
records, except as provided in §
99.31.
Agency or institution can
change the permissions settings
within the software to allow for,
or deny, access to certain types
of users.(See below page 6)
Course Settings
Same as above
Same as above
Agency or institution can
change the course settings
within the software to allow
certain users to access the
course.(See below page 7-8)
Account Settings
Same as above
Same as above
Agency or institution can
change the account settings
within the software to allow only
certain users to access features.
(See below page 9)
Names, not
potentially sensitive
contact information
are displayed in
Canvas(security
feature)
Same as above
Same as above
Canvas displays students’
names in the course; however
students’ email addresses or
phone numbers will not be
displayed. Students enrolled in
the same course can contact
one another, but the
communication will be mediated
through Canvas and students’
email addresses will not be
disclosed.
Log off inactive
users (security
feature)
Same as above
Same as above
Canvas automatically logs out
users after a period of inactivity.
6 May 2014
Instructure, Inc.
Access to educational records is
dictated by course enrollment
and role data provided by the
institution. Access inside of a
course can be further limited by
groupings of students.
17
Canvas Security
Instructure Security, Engineering, and Operations
Item
FERPA Section
Requirements
Comments
Browser Session
Logout(security
feature)
Same as above
Same as above
Once a browser session is
closed and a new browser is
opened, Canvas will require the
user to login again.
Authentication
Integration
Same as above
Same as above
Single-sign-on is highly
encouraged. All access to the
system is dictated by the
Institution-controlled identity
system (SAML 2.0, CAS, LDAP,
Shibboleth etc.).
6.2
Customization
Under FERPA, each school must define in their annual notification who constitutes a school
official and what constitutes a legitimate educational interest. 3 Because of this variation, Canvas
provides settings that can be configured to conform to each school’s definitions. This document
describes the various Canvas settings related to FERPA, the default settings, and the changes
that may be made to these settings.
6.3
Permissions
One of the main FERPA-related tools available to educational agencies is the ability to define
the permission settings for specific user roles in Canvas. Roles are established and
communicated within Canvas by the type of course or section enrollment. The management of
enrollments and the associated role permissions enable schools to specify what data each user
can view. Both instructor and teacher’s assistant enrollments can be limited to student data in a
section, which is a sub-group of the overall course enrollments. Enrollment data is typically
furnished via integration with the institution’s student information system (SIS). The default
permission settings can be changed to either allow or deny access to specific features and data.
To access the permission setting page in Canvas as shown in Figure 6–1, select “Permissions”
from the dashboard’s left hand menu in a Canvas course. In addition to the user roles of
Students, Teachers, and Course Designers, Canvas also has the predefined roles of:
3
•
TAs – individuals who serve as a teacher’s assistants.
•
Observers – individuals who have access to the course, but do not participate in the
course.
34 CFR § 99.7
6 May 2014
Instructure, Inc.
18
Canvas Security
Instructure Security, Engineering, and Operations
Figure 6–1. Specifying permission settings in Canvas by user group.
6.4
Course Settings
All data and course content is securely stored under an associated access control policy. Every
time the data or content is accessed, this access control policy is consulted before access is
granted to the requested resource. By default, Canvas only allows users enrolled in a course to
view course content. With the growing need for OpenCourseWare and open educational
resources, Canvas through the mechanism of these access control policies can safely permit
the sharing of course content publicly while protecting and maintaining the privacy all personal
and FERPA associated content. These policies support the sharing of continuously updated
course content without compromising data security.
The procedures below step through the process for making a course public while keeping all the
student data private and secure.
1. Click on “Courses” from the top-level navigation menu in the Canvas dashboard to
display the course selection page. Select the course for which you would like to change
the settings.
2. Select “Settings” from the left hand course menu to display the course details page as
shown in Figure 6–2.
3. Click on the “Edit Course Details” button at the bottom of the course details page.
6 May 2014
Instructure, Inc.
19
Canvas Security
Instructure Security, Engineering, and Operations
Figure 6–2. Course details page.
4. Select the box next to “Make this course publicly visible,” then click “Update Course
Details” as shown in Figure 6–3.
Figure 6–3. Setting the course visibility to public.
6 May 2014
Instructure, Inc.
20
Canvas Security
Instructure Security, Engineering, and Operations
6.5
Account Settings
6.5.1 Authentication Integration
Single Sign-On (SSO) is configured at the account level. SSO gives the institution full control
over which users are authenticated and how that authentication is performed. Role information
is communicated with enrollment data via integration with the institution’s SIS. Supported
identity protocols include LDAP, Active Directory, CAS, SAML 2.0, and Shibboleth.
6.5.2 Assessment Results in External Notifications
An educational agency can decide whether or not it will allow students to have the ability to optin to receiving grades by external notifications through email, SMS, or other communication
channels. By default, when an instructor assesses submitted assignments, students can receive
notifications that they have received a grade on a specific assignment, but the notification will
not include the grade received. If the educational agency has selected this option, it will allow
the student to consent or opt-in to receive the grade in the notification as well.
To change the default setting:
1. Click on the “Settings” tab located on the left hand menu of the dashboard.
2. By default, the Settings tab will be displayed as shown in Figure 6–4.
3. Click on “Students can opt-in to receiving scores in email notifications” and then click
“Update Settings.”
Figure 6–4. Allowing students to opt into receiving grades in notifications.
6 May 2014
Instructure, Inc.
21
Canvas Security
Instructure Security, Engineering, and Operations
Figure 6–5. Students can opt into receiving grades notifications in their account settings.
6.6
Other Default FERPA-related Features
Additional features in Canvas related to FERPA compliance include:
•
Inactive user logout. Canvas will automatically logout the user after a period of
inactivity.
•
Browser session logout. Once a browser session is closed and a new browser session
is opened, Canvas will require the user to login again.
•
Protection of sensitive contact information. Although Canvas displays students’
names, Canvas will not display students’ email addresses, phone numbers, and other
sensitive contact information to other students. Canvas mediates communications,
allowing users enrolled in the same course to contact one another without the disclosure
of users’ actual contact information. Administrators with the appropriate permissions can
access the audit and record of Canvas communications.
6 May 2014
Instructure, Inc.
22
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Appendix E.
E.1
Catalog – Registration and Payment Portal
Features and Functions
Catalog incorporates and combines all of the fundamental features and functions of a well-designed
website, course catalog, registration and enrollment processor, payment gateway, and certificate
authoring engine to be an easy-to-use, out-of-the-box e-commerce solution. Some of the advanced
LMS features and functions of Catalog include:
Attractive and Immediate Web Presence – With Catalog you have a modern website that is entirely
custom-branded to match your organization’s brand and image (see Figure 1). Catalog client
institutions enjoy offering their visitors and prospective learners the easiest user experience when
searching, filtering, and selecting the courses that appeal to them.
Figure 60. Catalog’s Custom Branded Site
11 September 2014
Instructure, Inc.
148
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Unique Course Landing Page – Catalog puts the power of customizing each course offering in your
hands (see Figure 2). For each course, you can create your own title, course description, upload
custom images, and tweak the many details you want to communicate to prospective enrollees.
Figure 2. Catalog’s Unique Course Landing Page
Self-Service Registration and Payment – Perhaps the most
powerful and time-saving of all Catalog’s features is its
seamless integration with Canvas, allowing learners to visit
the site, select courses they want to enroll in, create their own
Canvas account, pay (if applicable), and begin learning – all
without an action required from your administrators (see
Figure 3).
11 September 2014
Instructure, Inc.
149
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Figure 3. Catalog’s Registration and Payment Capabilities
Student Dashboard – Marketing courses effectively and converting website visitors to learners is
only half the obstacle Catalog users face to run a successful initiative. Fostering an environment in
which learners are engaged and organized is paramount to students completing courses and
returning for new skills and knowledge. Catalog’s Student Dashboard is a clean, modern interface
that each learner sees upon login (see Figure 4). The dashboard informs on which courses you are
currently enrolled in, which courses you’ve signed up for that are starting soon, and which courses
you’ve completed. You are also given a detailed summary about what each course is about, and how
much progress you’ve made towards completion and earning the certificate. For ultimate clarity, each
course listing has a link to resume the course exactly where the learner last left off.
Figure 4. Catalog’s Student Dashboard
11 September 2014
Instructure, Inc.
150
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Course Bundling – Catalog also provides flexibility in
offering courses as single learning experiences, as well as
bundling a series of courses together and marketing them
as one larger achievement. Whether you want to position a
three or nine-course learning path as a certification,
specialization, or program, Catalog provides the tools to
make this clear to your visitors. The Student Dashboard
also reflects a difference between completing single
courses, and making progress towards a larger group of
courses completed (see Figure 5).
Figure 5. Progress Towards
Intuitive Catalog Authoring Tools – Catalog’s authoring
Certification
tools live inside Canvas, so you don’t have to manage
multiple accounts to administrate simply and successfully.
Adding new courses to Catalog is as simple as typing in text entry boxes, while adding custom images
is an easy point-and-click process. The authoring tools extend themselves to writing the entire course
description, and even creating your own certificates to issue upon course completion (see Figures 6 &
7).
Figure 6. Catalog’s Intuitive Authoring Editor
11 September 2014
Instructure, Inc.
151
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Figure 7. Catalog’s Content and Image Editor
11 September 2014
Instructure, Inc.
152
State of North Carolina Dept of Public Instruction
RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14
Appendix F.
Signed Forms
The signed “Bid Form” is provided on the following page and the completed Insurance Certificate.
11 September 2014
Instructure, Inc.
153
DATE (MM/DD/YYYY)
CERTIFICATE OF LIABILITY INSURANCE
9/4/2014
THIS CERTIFICATE IS ISSUED AS A MATTER OF INFORMATION ONLY AND CONFERS NO RIGHTS UPON THE CERTIFICATE HOLDER. THIS
CERTIFICATE DOES NOT AFFIRMATIVELY OR NEGATIVELY AMEND, EXTEND OR ALTER THE COVERAGE AFFORDED BY THE POLICIES
BELOW. THIS CERTIFICATE OF INSURANCE DOES NOT CONSTITUTE A CONTRACT BETWEEN THE ISSUING INSURER(S), AUTHORIZED
REPRESENTATIVE OR PRODUCER, AND THE CERTIFICATE HOLDER.
IMPORTANT: If the certificate holder is an ADDITIONAL INSURED, the policy(ies) must be endorsed. If SUBROGATION IS WAIVED, subject to
the terms and conditions of the policy, certain policies may require an endorsement. A statement on this certificate does not confer rights to the
certificate holder in lieu of such endorsement(s).
CONTACT
Deborah Walling
NAME:
PHONE
(A/C, No, Ext): (801)325-5000
E-MAIL
ADDRESS: [email protected]
PRODUCER
Diversified Insurance Group
136 E. South Temple Street
Suite 2300
Salt Lake City
UT 84111
FAX
(A/C, No): (801)532-2804
INSURER(S) AFFORDING COVERAGE
NAIC #
Atlantic Specialty Insurance
INSURER B :Lloyds of London
27154
10736
INSURER A :
INSURED
Instructure, Inc.
6330 South 3000 East, Ste. 700
INSURER C :
INSURER D :
INSURER E :
Salt Lake City
UT 84121
INSURER F :
CERTIFICATE NUMBER:14-15 Master Casualty
COVERAGES
REVISION NUMBER:
THIS IS TO CERTIFY THAT THE POLICIES OF INSURANCE LISTED BELOW HAVE BEEN ISSUED TO THE INSURED NAMED ABOVE FOR THE POLICY PERIOD
INDICATED. NOTWITHSTANDING ANY REQUIREMENT, TERM OR CONDITION OF ANY CONTRACT OR OTHER DOCUMENT WITH RESPECT TO WHICH THIS
CERTIFICATE MAY BE ISSUED OR MAY PERTAIN, THE INSURANCE AFFORDED BY THE POLICIES DESCRIBED HEREIN IS SUBJECT TO ALL THE TERMS,
EXCLUSIONS AND CONDITIONS OF SUCH POLICIES. LIMITS SHOWN MAY HAVE BEEN REDUCED BY PAID CLAIMS.
INSR
LTR
ADDL SUBR
INSR WVD
TYPE OF INSURANCE
POLICY EFF
POLICY EXP
(MM/DD/YYYY) (MM/DD/YYYY)
POLICY NUMBER
GENERAL LIABILITY
X
A
COMMERCIAL GENERAL LIABILITY
CLAIMS-MADE
X
LIMITS
EACH OCCURRENCE
DAMAGE TO RENTED
PREMISES (Ea occurrence)
2/1/2014
711013122-0002
OCCUR
4/1/2015
MED EXP (Any one person)
PERSONAL & ADV INJURY
GENERAL AGGREGATE
PRODUCTS - COMP/OP AGG
GEN'L AGGREGATE LIMIT APPLIES PER:
PROPOLICY
LOC
JECT
AUTOMOBILE LIABILITY
$
X
ANY AUTO
ALL OWNED
AUTOS
A
X
HIRED AUTOS
X
711013122-0002
SCHEDULED
AUTOS
NON-OWNED
AUTOS
X
A
A
EXCESS LIAB
X
2/1/2014
4/1/2015
COMBINED SINGLE LIMIT
(Ea accident)
BODILY INJURY (Per person)
$
$
Includes Hired Auto
BODILY INJURY (Per accident) $
Physical Damage
PROPERTY DAMAGE
(Per accident)
$50K Limit/
UMBRELLA LIAB
1,000,000
500,000
15,000
$
$ Excl; See E&O
2,000,000
$
2,000,000
$
$
$
$
$500 Ded.
$
OCCUR
EACH OCCURRENCE
$
CLAIMS-MADE
AGGREGATE
$
DED
RETENTION $
WORKERS COMPENSATION
AND EMPLOYERS' LIABILITY
Y/N
ANY PROPRIETOR/PARTNER/EXECUTIVE
N/A
OFFICER/MEMBER EXCLUDED?
(Mandatory in NH)
If yes, describe under
DESCRIPTION OF OPERATIONS below
N
B Professional Errors &
711013122-0002
1,000,000
2/1/2014
4/1/2015
$
X
WC STATUTORY LIMITS
OTHER
E.L. EACH ACCIDENT
406038577-0002
2/1/2014
4/1/2015
470018
2/1/2014
4/1/2015
5,000,000
5,000,000
$
E.L. DISEASE - EA EMPLOYEE $
E.L. DISEASE - POLICY LIMIT
Limit/ Retention
$
500,000
500,000
500,000
$5MM/$50K
Omissions (Claims Made)
DESCRIPTION OF OPERATIONS / LOCATIONS / VEHICLES (Attach ACORD 101, Additional Remarks Schedule, if more space is required)
Evidence of insurance.
CERTIFICATE HOLDER
CANCELLATION
North Carolina Department of
Public Instruction
6330 Mail Service Center
Raleigh, NC 27699-6330
SHOULD ANY OF THE ABOVE DESCRIBED POLICIES BE CANCELLED BEFORE
THE EXPIRATION DATE THEREOF, NOTICE WILL BE DELIVERED IN
ACCORDANCE WITH THE POLICY PROVISIONS.
AUTHORIZED REPRESENTATIVE
Regan Guth/DWALL
ACORD 25 (2010/05)
INS025 (201005).01
© 1988-2010 ACORD CORPORATION. All rights reserved.
The ACORD name and logo are registered marks of ACORD
Was this manual useful for you? yes no
Thank you for your participation!

* Your assessment is very important for improving the work of artificial intelligence, which forms the content of this project

Download PDF

advertisement