How does the LMS RFP page differ from the LMS comparison checklist?

Same 60 items, opposite direction. The RFP page is the specification you demand of bidders (requirement level, evidence to submit, verification method). The LMS comparison checklist is the table you evaluate them with (how to verify, owning function, rating scale). Before the RFP goes out, read the RFP page; once proposals arrive and you are running demos, read the checklist. The item numbers match, so an RFP response drops straight into the comparison table. Checklist: https://www.touchclass.com/en/lms-comparison-checklist

LMS RFP

How to write an LMS RFP

Q: How do you stop bidders answering 'yes, we support that'?

There is one thing that works: the buyer states first what must be submitted before support is credited. Write it as a document: the certificate and its certified scope, the load-test figure and the test conditions, three years of incident history, an actual exported file. Then state in the RFP instructions that 'Met' with no attachment is treated as no response. A requirement with no evidence attached is not a requirement, it is a wish.

Q: How do you verify an LMS vendor's operating scale?

'Used by many large enterprises' is not a verifiable statement. Ask for the largest learner count for a single customer, and write in the RFP that the sum of all customers will not be accepted. For load tests, take the test conditions (tooling, scenario, date of measurement, infrastructure) alongside the number, and state in the requirement that the figure is not a guaranteed steady-state capacity. TouchClass submits a largest single customer of 39,000 learners and an 18,000-concurrent load-test result (not a guaranteed steady-state capacity). Source: https://www.touchclass.com/en/lms-benchmark#operating-scale

Q: Where do AI requirements go in an LMS RFP?

In their own chapter, never blended into the general functional requirements. Write 'does it have AI' as one functional line and the answer comes back 'yes, supported', with the controls, the evidence and the cost model all missing. AI runs on a different axis: data, then control, then validation. Lift the 8 AI control requirements (exclusion from model training, blocking external transmission, call-scope limits, input/output validation, source attribution, audit logging, export and deletion evidence, permission-based output control) and the AI RFP steps from https://www.touchclass.com/en/ai-lms

Q: Does TouchClass meet all 60 requirements?

No. Three of them are answered conditionally. On item 35, skills graph: interest-keyword curation is supported, but a structured role-and-competency graph requires separate design work. On item 43, separation of AI output from high-stakes HR decisions: the features exist, but separating them from promotion, appraisal and compensation needs the customer's own policy, approval path and audit structure. On item 53, capture prevention: capture logging and masking are supported, but on iOS complete blocking is not claimed, as it is an OS-level constraint. All three are published as they are. A proposal with no conditional responses at all is the one worth a second look.

Current as of July 2026 · 60 requirements

An RFP is not a feature list. It is a requirements specification. Fix the requirement level (Must · Should · May), the evidence to be submitted, and the verification method on every single line, and the proposals come back on the same axis. All 60 requirements across 9 categories, the 8 drafting steps, and the 5 pieces of evidence to demand from any vendor — published in full, no form.

requirements
9 categories

Must items
failure = disqualified

drafting steps
scope → exit terms

See all 60 requirements Download the CSV (no form)

RFPs fail because each bidder is asked a different question

Most teams get stuck at the same point. Three proposals arrive and none of them can be compared. One is eighty screenshots of features, one is a stack of case studies, one is a price sheet. The cause is not the bidders. It is the RFP. When a requirement reads "excellent learning management functionality," every bidder maps whatever they happen to be good at onto that sentence — and they are all telling the truth.

There is one fix: the same requirement, the same verification method, the same rating scale. For every single line, pin down ① the requirement level (Must · Should · May), ② the evidence the bidder must submit (down to the document name), and ③ how the buyer will verify it (demo · document · PoC · pilot · contract clause). The moment those three cells are filled, the answer "yes, we support that" stops being an answer.

This page publishes 60 requirements across 9 categories in exactly that form. Copy the tables into your requirements specification, add a response column per bidder, and send it out. You will not find a single vendor name here — who makes your shortlist is the buying organisation's call, not a vendor's.

If you are already past the RFP and building a comparison table, the document you want is the 60-item LMS comparison checklist, not this one. Both use the same 60 items, but they point in opposite directions — the checklist evaluates bidders, this page specifies what to demand of them. The split is set out in the table below.

The 8 steps of an LMS RFP

Full replacement, or one slice running alongside the incumbent? Until that sentence exists, each bidder sizes a different deal and the prices cannot be compared. Put the headcount, the term, whether the existing system stays, and the budget band on page one. Framing it as a full replacement raises the decision unit so high that the conclusion slips — and the incumbent usually stays by default.
Recommended first scope: 50–100 learners · 4 weeks · one training task · incumbent stays
If the buyer will not table its own current state, no one can quote. Write down learner count, courses run per year, which mandatory training you carry, the systems you integrate with (HRIS · groupware · portal), the formats and volume of content you hold, and the formats your current data can actually be exported in. Without that table, integration effort and content migration all come back as "to be discussed separately."
Anything returned as "to be discussed separately" is something you will be invoiced for later
Writing every requirement at the same weight is the same as requiring nothing. Must means disqualification if unmet, Should is scored, May is a bonus. The 60 requirements below split 32 Must · 27 Should · 1 May, and all eight security requirements are Must.
32 Must · 27 Should · 1 May — all 8 security items are Must
The answer "yes, we support that" stops in exactly one situation: the buyer has already stated what must be submitted before support is credited. Write it as a document: the certificate itself and its certified scope, the load-test figure and the test conditions, the incident history for the last three years, an actual exported file. A requirement with no evidence attached is not a requirement. It is a wish.
A ticked box is not evidence — name the document, the screen, the file
If the bidder writes the demo script, you will only ever see the parts they are good at. Assign each requirement one method: demo, document review, PoC, four-week pilot, or contract-clause check. Authoring capability is not "does the feature exist" — it is how long it takes one administrator to build one piece of content from a PDF you hand them on the day.
The scenario, the sample data and the metric all come from the buyer
Hide the weighting and bidders compete on price alone. State the technical-to-price split, whether an unmet Must item disqualifies, and how a conditional response (partial support, policy-dependent, custom development) will be treated. Zero, a deduction, or a pre-adoption task? The buyer decides. Decide it before evaluation day, or you will be arguing about it on evaluation day.
A proposal with no conditional responses at all has told you something in itself
Compare year-one licence fees and the ranking flips in year three. Take licence, per-seat step pricing, contract minimum, content subscription, integration effort, operational support, the cap on annual uplifts, and the cost of getting out — all on one template. A blank cell in a quotation is not zero. It is "not stated", and it should be scored down. For the lines to put on that template and what they run to by company size, see what an LMS actually costs — every figure is shown with its arithmetic.
A blank is not zero — it is what you get invoiced for later
Termination is not something to negotiate when the contract is drafted. It is something to put in the RFP so that it is answered at proposal stage. Data export format (file format · schema · how long it takes), ownership of content you created, the scope of learning history you can take with you, transition support period, notice period — all of it sits in requirement 60. Verification means actually opening the exported sample file.
Look at the way out before you look at the way in

1. Scope — the sentence on page one

Headcount and org unit

Whole company, or one division?

What happens to the incumbent

Replace / run alongside / phase out

Term and budget band

1 year or 3 — the TCO baseline

"Enterprise LMS modernisation" → "One division, 800 learners, 3 years, incumbent stays"

Blurred scope means prices that cannot be compared

2. As-is inventory — the RFP attachment

Learners · admins · courses run per year

Mandatory training carried, and who it applies to

Integrations — HRIS · groupware · portal · SSO

Content held — format · count · volume

Formats your current LMS can export

If that last line is blank, start with the LMS you already run

3. Requirement levels — how the 60 split

Must

Should

May

Must — unmet means disqualified

Should — scored

May — bonus only

All 8 security & privacy requirements are Must

4. Evidence — turn answers into documents

"We hold security certification" → Certificate · certified scope · validity · audit history

"We operate at scale" → Largest single-customer learner count · load-test conditions

"Stable operation" → 3-year incident history · recovery times · SLA

A requirement with no evidence is a wish

5. Verification — pick one per requirement

Demo

on data
you supply

Doc

review the
original

PoC

integrate in
your environment

4-week pilot · contract clause

Let the bidder script the demo and you see only their best angle

6. Scoring & disqualification — in the RFP

Must item unmet

any 1 of the 32

Disqualified

Conditional response

partial · custom build assumed

Deduction

No evidence attached

"provided at contract stage"

Deduction

Undecided rules become arguments on evaluation day

7. Three-year TCO — one template

Licence · per-seat step pricing · contract minimum

Content subscription · integration effort · support

Cap on annual uplift

Cost of exit — migration and export

A blank cell in the quote → not zero — "not stated", and scored down

Compare year one only and the ranking flips in year three

8. Exit terms — check the door out first

Notice → Data export → Transition support

Export format — file type · schema · lead time

Ownership of content you created

Learning-history export scope · data deletion process

Verification means actually opening the exported file

What belongs in the RFP but is not repeated on this page

The five items below already exist elsewhere, with their requirement wording and evidence tables written out. Writing them twice guarantees the two copies will eventually disagree.
All this section does is tell you where to look and what to lift.

AI requirements

The 8 AI control requirements

Exclusion from model training · blocking external transmission · call-scope limits · input/output validation · source attribution · audit logging · export and deletion evidence · permission-based output control. Each one comes with the evidence to demand. Lift them straight into your security section.

/en/ai-lms#ailms-controls → AI RFP procedure

Writing an AI LMS RFP — 8 steps

The eight steps on this page run along the general procurement axis (scope → inventory → levels → evidence → verification → scoring → TCO → exit). AI runs along a different one: data → control → validation. Do not blend them. Keep AI as a separate chapter.

/en/ai-lms#ailms-rfp → Public tender, in practice

What a real RFP actually asked for

A published Korean public-sector RFP: structuring roughly 230GB of internal material and a 718-question item bank for RAG; 33 requirements across function, performance, interface, security, testing, management and support; scoring weighted 80 technical to 20 price. A useful reference for how to weight your own.

/en/ai-lms → Interoperability standards

xAPI · LTI · Open Badges 3.0 · CLR 2.0

If learning data only ever lands in a vendor's proprietary format, changing platform erases years of learning history. What to require and what to check, standard by standard, is tabulated there. Fold it into requirements 54–55 and 60.

/en/lms-vs-lxp#lxp-standards → Demand operating data

107 companies, 35 months of MAU

Median MAU for non-mandatory training: 23%. First quartile 9%, third quartile 52% (n=75). Ask your vendors for operating data at this resolution — not how many customers they signed, but how much the product was actually used afterwards. It is the baseline for your own expectations.

/en/lms-benchmark → Scale verification

Selection criterion 8 — proven operating scale

"Used by many large enterprises" is not a verifiable statement. How to ask instead for the largest single-customer learner count (not the sum of all customers) and the measurement conditions behind a load test. This is the basis for requirement 56.

/en/lms-selection#criterion-operating-scale →

Keep it separate

Do not fold AI requirements into the general functional requirements. Write "does it have AI features" as a single functional line and the answer comes back as "yes, supported" — with the controls, the evidence and the cost model all missing. Keep AI as its own chapter in the RFP and cite the 8 control requirements and their evidence from the document that already carries them.

Requirement levels and response rules

The rating scale (◎ ○ △ ×) is the ruler you use to evaluate bidders. The requirement level (Must · Should · May) is the ruler you use to demand things of them.
Same 60 items, opposite directions.

The three requirement levels

The three LMS RFP requirement levels — Must, Should and May, with how each is treated in evaluation
Level	Meaning	Count	If unmet	Priority in the comparison checklist
Must	Operations do not hold without it — the bidder has to meet it	32	Disqualified. It only has force if you write "disqualified", not "deduction"	P1
Should	Drives operating quality and participation — scored	27	Deduction. Require the reason and the workaround in writing	P2
May	Bonus if present — not used to decide the award	1	Bonus only. This item never flips the ranking	P3

The requirement levels map 1:1 onto the priorities (P1 · P2 · P3) in the LMS comparison checklist. It is the same 60 items rewritten for procurement, so the item numbers are identical too.

Bidder response rules — wording you can paste into the RFP instructions

Leave the response format open and the proposals come back as prose. State these four response types, and what each one has to be accompanied by, in the RFP instructions.

The four bidder response types and the attachments to require for each
Response	What the bidder means	Attachment to require	How the buyer treats it
Met	The requirement is satisfied by the product as it stands today	The evidence document or screen. State in the instructions that "Met" with no attachment is treated as no response	Verified by demo or document
Conditionally met	Partial — it depends on a policy, a configuration or custom development	The precondition, the extra cost, the lead time, and who owns it	If it is a Must item, apply the disqualification rule you published
Not met	Not supported today	The workaround, and the roadmap date — stating whether it is binding	If it is a Must item, disqualified
Not applicable	The bidder judges it out of scope for this procurement	The reasoning behind that judgement	The buyer decides — not the bidder

Response column

The specification below has no vendor column. It is not a table for ranking suppliers. When you distribute it, add four columns on the right — response type · evidence document · verification date · owner — and leave the "candidate under review" column empty for each bidder to fill in. The CSV ships in exactly that shape.

LMS RFP requirements specification — all 60

Nine categories, 60 requirements, published in full. Each row carries a requirement level, the requirement statement, the evidence to submit and the verification method, so it can be lifted straight into a requirements specification.
Verification tags: Demo · Doc · PoC · Pilot · Contract.

ALearning strategy1–6 BLearner experience7–14 CAdmin operations15–22 DContent & assessment23–30 EEngagement · LXP · AI31–38 FData & analytics39–45 GSecurity & privacy46–53 HIntegration & scale54–57 ICost & contract58–60

The tables scroll horizontally on narrow screens. Columns: No. · level · requirement · evidence to submit · verification method.

A. Learning strategy & outcome fit (1–6)

Does the training purpose survive contact with the system's structure? Three Must items — automated mandatory training, role-based learning paths, and validating one slice in a 4-week pilot without replacing anything.

A. Learning strategy and outcome fit — LMS RFP requirements 1 to 6
No.	Level	Requirement	Evidence to submit	Verification
1	Must	Mandatory, ethics/compliance and internal required training shall be assignable at course level, with completion tracked automatically.	Required-course configuration screen, cohort bulk-assignment procedure, sample non-completer report	DemoRegister a course → assign a cohort → produce the non-completer report, without stopping
2	Must	Courses shall be classifiable by role, department and function, and operable as staged learning paths.	Learning-path configuration screen, a sample departmental curriculum	DemoBuild the curriculum for one department the buyer names, live
3	Should	Employees, new hires, partners and campaign staff shall be operable as separate learner cohorts.	Group / permission / course-assignment matrix	DemoWalk three cohort scenarios
4	Should	Training shall extend past completion tracking into knowledge sharing, case sharing and Q&A.	Specification for boards, comments, attachments and private posts	DemoCreate a topic → set permissions → show anonymous and private posts
5	Must	It shall be possible to validate one slice in a 4-week pilot without replacing the incumbent LMS.	A 50–100 learner pilot brief — scope, duration, KPIs, cost, exit conditions	PilotMeasured before contract. State whether pilot cost is credited against the main contract
6	Should	Outcome metrics — participation, completion, admin workload, ticket volume — shall be agreed up front and then measured.	KPI derivation document, sample before/after pilot reports	PilotCompare the before and after reports

B. Learner experience & accessibility (7–14)

Will learners actually log in? Four Must items — cross-platform progress sync, a genuinely native app, push nudges, and web accessibility.

B. Learner experience and accessibility — LMS RFP requirements 7 to 14
No.	Level	Requirement	Evidence to submit	Verification
7	Must	Web, iOS and Android shall all be supported, with learning progress synchronised across devices.	Supported OS and browser version table, progress-sync design document	DemoStart on desktop, resume on mobile
8	Must	The mobile app shall not be a wrapped web view: it shall use device capabilities — push, offline storage, biometrics.	App architecture document stating explicitly which parts are native and which are web view, store listing	DemoReceive a push and play offline, on a real device
9	Should	A customer-branded standalone app or a customised learning experience shall be deliverable.	White-label scope table, store submission route and lead time, additional cost	DocCheck the store link of an existing standalone app
10	Must	Deadlines, new courses and non-completion nudges shall be sendable as app push or messages.	Audience segmentation rules, scheduled-send screen, delivery report template	DemoSchedule a targeted push → receive it → pull the delivery report
11	Should	Self-directed study tools — search, bookmarks, notes, highlighting, TTS — shall be provided.	Feature list for the learner-facing screens	DemoDrive it from a learner account
12	Should	Multilingual UI and content translation shall be sufficient for global and partner training.	Supported language list, separating UI from content translation, plus a translation sample	DemoTranslate one piece of content the buyer supplies
13	Must	Screen, content and mobile usability shall be verifiable against web accessibility standards (WCAG 2.2).	Self-assessment checklist, keyboard and screen-reader results, whether formal certification is held	DocDemoComplete one course end to end using a screen reader
14	Should	A microlearning / short-form experience consumable in minutes shall be provided.	Short-form production process, course conversion-rate report template	DemoOne video → short form → conversion statistics

C. Admin operations & workload (15–22)

The densest Must category — six of eight. Admin workload scales with headcount, so any manual step left standing is the step that sets your three-year cost.

C. Admin operations and workload — LMS RFP requirements 15 to 22
No.	Level	Requirement	Evidence to submit	Verification
15	Must	Learners shall be enrollable individually, in bulk by CSV, by invite link, and through SSO.	Procedure per enrolment method, CSV template and field definitions	DemoUpload 10 learners by CSV — including how error rows are handled
16	Must	Groups by department, role, project or partner shall be creatable and reusable for assignment, statistics and messaging.	Group design document, list of group-level statistics	DemoCreate a group → assign a course → read the group statistics
17	Must	Required/optional status, enrolment window, progress thresholds and test/survey conditions shall be settable per course.	Full list of course configuration options	DemoRegister one course, then change its conditions live
18	Must	Completion conditions shall be judged automatically and certificates issued.	Completion-condition table (progress, study time, score, survey, video playback), certificate template	DemoJudge a passing account and a failing one side by side
19	Must	Admin and sub-admin menu permissions shall be separable so that operational responsibility can be divided.	Permission matrix (role × menu × action)	DemoLog in as a sub-admin and show the difference
20	Should	QR attendance, manual credit and attendance cancellation shall be manageable for offline sessions and events.	Attendance screen specification, how attendance feeds completion judgement	DemoQR check-in → manual credit → cancellation
21	Must	Live users, recent activity, enrolment logs and bulk-job status shall be visible from the admin console.	Operations dashboard item list, bulk-job queue screen	DemoThe live operations dashboard, not a mock-up
22	Should	The scope and ownership (RACI) of admin training, content migration, launch support and operational reviews shall be stated.	Onboarding schedule, RACI, and an explicit in-scope / out-of-scope list	ContractAttach the support scope as a contract schedule

D. Content, authoring & assessment (23–30)

"Does it have an authoring tool" is not a requirement. Make the verification method how long one administrator takes to build one piece of content. Requirement 30 is checked in the contract, not the demo.

D. Content, authoring and assessment — LMS RFP requirements 23 to 30
No.	Level	Requirement	Evidence to submit	Verification
23	Must	Text, images, video, audio, PDF, quizzes, tests and surveys shall be combinable into content without writing code.	List of supported content elements, editor manual	DemoBuild it live from a PDF or deck the buyer hands over — and time it
24	Should	Desktop, tablet and mobile views shall be previewable and the content adjustable responsively.	Preview breakpoints	DemoPreview at three breakpoints
25	Should	Video, audio, PDF, embedded external video and internal links shall all be operable.	Supported file formats and size limits, streaming method	DemoUpload and link-embed test
26	Must	Quizzes, tests and surveys shall be buildable with auto-grading, result-release settings and manual grading.	Question type list, grading and result-release configuration screen, anti-cheating measures	DemoBuild one quiz and one test, then sit them
27	Should	AI shall be able to draft content, images, translations and summaries from a document or URL. AI control evidence shall be submitted alongside.	AI feature specification, plus the evidence listed under the 8 AI control requirements	DemoDocDemand the demo and the control documents together
28	Should	Long video shall be convertible into short-form learning that then drives learners into the full course.	Conversion process, definition of the conversion-rate calculation	DemoConvert one video, then read the conversion statistics
29	Should	Beyond in-house content, an e-learning / short-form content library shall be selectable.	Content catalogue, subscription pricing and renewal terms	DocCheck the actual catalogue against the price list
30	Must	Ownership of customer-created content and the export format on termination shall be guaranteed contractually.	Draft contract clause, and an actual exported file (HTML or equivalent)	ContractDemoDownload the export and open it

E. Engagement, LXP & AI personalization (31–38)

This category has no Must items at all, and that is deliberate. Make engagement features mandatory before mandatory training, completion, permissions and security are in place, and the RFP becomes a technology-led purchase. Requirement 35 is one TouchClass answers conditionally.

E. Engagement, LXP and AI personalization — LMS RFP requirements 31 to 38
No.	Level	Requirement	Evidence to submit	Verification
31	Should	Social learning — boards, comments, likes, saves, private posts, anonymous topics — shall be operable. See social learning.	Topic permission design, anonymity and private-post policy, reporting and blocking tools	DemoOpen an anonymous topic → private post → statistics
32	Should	Voluntary participation shall be designable using points, badges, frames and rankings.	Point-award condition list, how rankings are calculated	DemoBuild one campaign live
33	Should	Live sessions, chat, attendance, replay and attendee export shall be handled inside the platform.	Maximum live duration and concurrent-viewer limits, attendee export format	DemoRun a live broadcast test, then export the attendee list
34	Should	Participatory formats beyond training — surveys, events, VOC, field case sharing — shall be supported.	Examples of campaign topics and surveys in production use	DocReview the list of deployments
35	Should	Career paths and learning recommendations shall be connectable against a role / competency / skills graph. TouchClass: conditional	Role-to-skill mapping structure, HRIS data integration design, scope and cost of any custom build	DocPoCAsk for the underlying skills taxonomy from an existing deployment
36	Should	Personalized recommendation shall be offered from popular searches, behavioural history and interest keywords.	Document explaining the basis of recommendation — what is observed, what is recommended	DemoRequire the system to explain why it recommended each item
37	Should	An AI assistant shall handle course FAQs and material-grounded Q&A.	Source-attribution screen, usage statistics, plus the AI control evidence	DemoAttach the buyer's PDF, ask a question, check that sources are cited
38	May	The mobile home, recommended courses, popular courses, rankings and saved items shall be composable into a learner home.	List of home components	DemoThe learner home configuration screen

F. Data, analytics & measurement (39–45)

Not "is there a statistics screen" but does it come out in a form you can hand to audit. Requirement 43 is one TouchClass answers conditionally.

F. Data, analytics and measurement — LMS RFP requirements 39 to 45
No.	Level	Requirement	Evidence to submit	Verification
39	Must	Statistics shall be provided for logins, courses, content, feedback, short-form, chatbot and group comparison.	Item table per statistics menu, download formats, aggregation cadence	DemoWalk every statistics menu
40	Must	Non-login, non-completion and per-learner reports shall be downloadable and usable as audit and reporting evidence.	An actual sample CSV, and the personal-data masking policy	DemoOpen the downloaded file and inspect its columns
41	Should	Study volume, activity and engagement shall be comparable across departments and groups.	Sample group-comparison report (2–10 groups)	DemoProduce the group-comparison report
42	Should	Metrics shall show whether short-form learning actually converted into course learning.	Definition of the conversion-rate calculation (numerator, denominator, window)	DocRequire the calculation in writing
43	Must	AI recommendation and analysis outputs shall be kept separate from high-stakes HR decisions such as promotion, appraisal and compensation. TouchClass: conditional	Data-use policy, human review step, audit-log design	DocContractPut the permitted use of learning data in the contract
44	Should	KPIs — participation, production time, ticket volume, admin workload — shall be comparable before and after a pilot.	Before/after report template	PilotCompare across the 4-week pilot
45	Should	Natural-language admin queries or report automation shall reduce time spent on operational analysis.	Which data the query layer can reach, and how it shows its basis	DemoAsk three questions the buyer wrote, on the day

G. Security, privacy & compliance (46–53)

All eight are Must. An LMS accumulates employee personal data and internal training material in the same place, which makes the processor itself the object of review. Requirement 53 is one TouchClass answers conditionally.

G. Security, privacy and compliance — LMS RFP requirements 46 to 53
No.	Level	Requirement	Evidence to submit	Verification
46	Must	An information-security and privacy management-system certification, and an international information-security certification, shall be produced.	The certificate itself, the certified scope, the validity period, the latest surveillance-audit record	DocThe buyer looks it up directly on the certification body's site — not the submitted copy alone
47	Must	A record of passing enterprise or financial-sector processor security audits shall be produced, with evidence of data minimization, processing arrangements and liability insurance.	Document stating auditing body, year and score (or pass status); security questionnaire responses; insurance certificate	DocCross-check against the data-processing agreement
48	Must	Encryption at rest and in transit, data residency and access-control principles shall be explained.	Security architecture document, named hosting region, encryption method	DocReview the architecture document
49	Must	Admin, sub-admin and learner permissions shall be separable and operable on least privilege.	Permission matrix, admin activity-log policy	DemoThree accounts, one per role, side by side
50	Must	SSO, SAML 2.0, OAuth 2.0, LDAP/AD, and MFA or biometric federation shall be supported.	Integration documentation, a reference deployment on the same protocol	PoCFederate against the buyer's own IdP — documentation alone is not acceptance
51	Must	Audit tracing shall be possible — admin activity logs, source IP, menu activity, screen-capture logs.	Log field table, retention period, who can query and how logs are exported	DemoQuery one administrator's past activity, live
52	Must	Continuous-uptime record, incident history, and backup and high-availability procedures shall be produced as documents.	Length of uninterrupted operation, incident history for the last three years (date, blast radius, recovery time), SLA, incident-response procedure	DocIf the answer is "zero incidents", require the measurement method and what counts
53	Must	Content leak-prevention measures — capture prevention, watermarking, download control — shall be stated. TouchClass: conditional	Coverage table by OS (iOS and Android stated separately), capture-log and masking policy	DemoTry to capture on a real device. If "complete blocking" is claimed, require the OS-policy basis

Reference standards: https://isms-p.or.kr/sysm/intro/selectSysmCertDetail.do · https://www.iso.org/standard/27001 · https://www.nist.gov/itl/applied-cybersecurity/special-publication-800-63 · https://www.w3.org/TR/WCAG22/

H. Integration, scale & interoperability (54–57)

The requirement wording for interoperability standards (xAPI · LTI · Open Badges 3.0 · CLR 2.0) is tabulated in a separate document. Fold it into 54–55.

H. Integration, scale and interoperability — LMS RFP requirements 54 to 57
No.	Level	Requirement	Evidence to submit	Verification
54	Must	Account, org and learning data shall be integrable with HRIS, ERP, CRM, groupware and portals.	Target system list, data field mapping table, sync cadence and failure handling	DocPoCDesign the actual mapping against one of the buyer's systems
55	Should	Integration method (API, webhook, CSV) shall be selectable in stages, with cost and timeline quoted separately. Support for standard learning-data formats shall be stated.	API documentation, integration quote (effort and duration itemised), xAPI · LTI support coverage	DocCheck the real API docs against the quoted line items
56	Must	A track record of operating at thousands-to-tens-of-thousands scale, and peak-concurrency load-test results, shall be produced as documents.	Largest single-customer learner count (not the sum of all customers), load-test result values and test conditions (tooling, scenario, when it was measured)	DocUse the wording in the 5 evidence items below verbatim
57	Should	A standalone domain, white-label and a customer-branded experience shall be extendable.	Domain and app branding scope, additional cost	DocReview existing deployments

I. Implementation, support, cost & contract (58–60)

All three are Must. Whatever is blank in the quotation is what gets invoiced later.

I. Implementation, support, cost and contract — LMS RFP requirements 58 to 60
No.	Level	Requirement	Evidence to submit	Verification
58	Must	The implementation-support scope and RACI — site setup, content migration, admin training, pilot operation — shall be stated.	Onboarding schedule, RACI, and an explicit in-scope / out-of-scope list	ContractAttach the support scope as a contract schedule
59	Must	A three-year total cost of ownership — licence, per-user charges, content subscription, integration, operational support — shall be submitted on one common template.	Three-year cost table, per-seat step pricing, contract minimum, cap on annual uplift, cost of exit	DocA blank is not zero — it is "not stated", and it is scored down
60	Must	Termination, data export, content ownership and notice conditions shall be defined.	Draft contract, termination process, a sample export file, transition support period, data-deletion procedure	ContractDemoDownload the sample export and open it

Candidate column

The "candidate under review" column is left blank. Who makes the shortlist is the buying organisation's decision, and it is not this document's place to make it. Copy the tables, add one column per candidate, and let each bidder fill in their own response type, evidence document and verification date.

The 5 pieces of evidence to demand from any vendor

These five cannot be answered with words. Lift the requirement wording straight into your RFP.
The right-hand column carries what TouchClass submits, with the source link — ask for the same shape from every candidate.

The five key pieces of evidence to demand in an LMS RFP, and what TouchClass submits for each
Evidence	Wording for the RFP	Why it has to take this form	What TouchClass submits
1. Load-test results	"Submit the peak-concurrency load-test results and the test conditions (tooling · scenario · date of measurement · infrastructure) as a document."	A number on its own tells you nothing about the conditions that produced it. A load-test figure is not a guaranteed steady-state capacity — put that distinction in the requirement wording and there is nothing to argue about later.	18,000 concurrent users, load-test result (not a guaranteed steady-state capacity) Source: https://www.touchclass.com/en/lms-benchmark#operating-scale
2. Largest single-customer learner count	"Submit the largest learner count for a single customer. The sum of all customers will not be accepted."	"Used by many large enterprises" is not a verifiable statement. 100 customers × 300 learners and one customer × 30,000 learners are entirely different operational problems. The one figure that is comparable to your own scale is the largest single customer.	Largest single customer: 39,000 learners · 17 financial institutions, about 135,800 cumulative users Source: https://www.touchclass.com/en/lms-benchmark#operating-scale
3. Uptime record and incident history	"Submit the length of continuous operation and the incident history for the last three years (date · blast radius · recovery time), with the SLA and incident-response procedure."	If the answer comes back "zero incidents", ask how they measure and what counts. Not recording incidents is not the same as not having them. The vendor with a history is often the one with a response procedure.	AWS-based · five years of uninterrupted operation in the financial sector. SLA and incident-history documents are provided at contract stage Source: https://www.touchclass.com/en/lms-benchmark#operating-scale
4. Processor security-audit record	"Submit, as a document, the auditing body, year and score (or pass status) of enterprise or financial-sector processor security audits, with questionnaire responses and supporting evidence."	Holding a certification and passing a customer's own audit are different things. Financial-sector processor audits go deeper than the certification schemes, and having passed one means someone has already taken the vendor apart.	Processor security audit: 99.1 points (2023) · data minimization · liability insurance Source: https://www.touchclass.com/en/lms-benchmark#operating-scale
5. Verification with the certification body	"Submit the certificate, certified scope, validity period and surveillance-audit history. The buyer will look these up directly on the certification body's site."	A submitted PDF will not tell you whether the certified scope covers the whole service or only part of it. A narrowly scoped certification does not guarantee that your data falls inside it. The buyer does the lookup.	ISMS-P and ISO/IEC 27001. Look them up at https://isms-p.or.kr · https://www.iso.org/standard/27001 Detail: https://www.touchclass.com/en/security

Ask for operating data too. What decides the outcome three years out is not how many customers a vendor signed, but how much the product was actually used afterwards. Across 107 Korean companies and 35 months of logs, median MAU for non-mandatory training was 23%, first quartile 9%, third quartile 52% (n=75). Ask whether your vendors can produce a distribution at that resolution — the source is published in full, no form, at https://www.touchclass.com/en/lms-benchmark.

The 3 requirements TouchClass answers conditionally

Of the 60 requirements, there are three TouchClass does not answer "Met" on. They stay on the page.
From the buyer's side of the table, a proposal with no conditional responses at all is the one worth a second look.

Requirement 35 · Should

Career paths against a role-and-skills graph

Interest-keyword curation and recommendation are supported. A structured role-and-competency skills graph is not — it requires separate design work. We do not answer this with an off-the-shelf taxonomy shipped inside the product.

Ask every candidate the same thing. Is the skills taxonomy built into the product, or does the customer build it? If it is built in, demand its source and how often it is refreshed.

Requirement 43 · Must

Separating AI output from high-stakes HR decisions

The AI recommendation and analysis features exist. But separating their output from promotion, appraisal and compensation is not something a product feature completes. It needs the customer's own data-use policy, approval path and audit structure alongside it.

Be wary of any vendor who answers this with a feature. The right response here is not a feature list. It is a sentence committing to put the permitted use of learning data in the contract.

Requirement 53 · Must

Capture prevention — the iOS constraint

Capture logging and masking are supported. But on iOS we do not claim complete blocking, because it is an OS-level constraint. This is not one product's limitation; it is what the platform policy permits.

If a bidder claims "complete blocking", require the basis. Get a coverage table by OS with iOS and Android stated separately, and try to capture on a real device yourself.

These are the same three items rated △ (partially supported) in the LMS comparison checklist. The two documents always point at the same value — △ in the comparison table, "conditionally met" in the RFP. Only the wording changes.

Download all 60 requirements

No form, no login, no email. All 60 items published as a CSV.
The "Current LMS" column ships empty, so widen it to one column per candidate and send it out as it is.

LMS requirements, 60 items (CSV · English)

No. · category · priority (P1–P3 = Must · Should · May) · item · how to verify · owner · current LMS (blank) · TouchClass rating · note.
It is the same file as the LMS comparison checklist — two documents, one dataset, two directions.

Download the CSV

The priority column in the CSV (P1 · P2 · P3) maps 1:1 onto the requirement levels on this page (Must · Should · May). We do not ship a second file, because the moment the same data lives in two files, the two files eventually disagree.

How this differs from the LMS comparison checklist

Both documents use the same 60 items. But they are used at different stages, and the tables point in opposite directions.
Which one you want depends on where you are.

The difference between the LMS RFP document and the LMS comparison checklist — purpose, stage and direction
	This page — LMS RFP	LMS comparison checklist
Purpose	Demand things of bidders — a requirements specification	Evaluate bidders — a comparison table
Stage	Before the RFP goes out — procurement	After proposals arrive, during demos — evaluation
Ruler	Requirement level — Must Should May	Rating scale — ◎3 / ○2 / △1 / ×0
Columns	Requirement · evidence to submit · verification method	Checklist item · how to verify · owner · current LMS · rating
Decision rule	A Must item unmet → disqualified	Read the gaps in the P1 items, not the total score
Output	A requirements specification and a scoring sheet	A per-bidder comparison table and a pre-adoption task list
Where to read	This page	https://www.touchclass.com/en/lms-comparison-checklist

The two documents share item numbers by design. A bidder's response to RFP requirement 43 drops straight into cell 43 of the comparison table.

Frequently asked questions

The eight questions that actually come up when a team sits down to write an LMS RFP.

How do you write an LMS RFP?

State the scope in one sentence, attach your as-is inventory, then split the requirements into Must, Should and May. Next, name the evidence for each requirement down to the document, and fix the verification method yourself (demo, document, PoC, pilot, contract clause). Finally, publish the scoring and disqualification rules in the RFP, take the pricing as a three-year TCO, and demand the exit terms at proposal stage. Follow those eight steps and three proposals come back on the same axis.

How do you set requirement levels (Must / Should / May)?

Must means operations do not hold without it, and it only has force if you write disqualified rather than "deduction". There are 32 of them across 60: automated mandatory training, automatic completion judgement, permission separation, all eight security items, three-year TCO and termination terms. Should covers the 27 scored items; May is a single bonus. The engagement / LXP / AI category has no Must items at all, and that is deliberate — make AI mandatory before mandatory training and security are in place, and the RFP becomes a technology-led purchase.

How do you stop bidders answering "yes, we support that"?

There is one thing that works: the buyer states first what must be submitted before support is credited. Write it as a document: the certificate and its certified scope, the load-test figure and the test conditions, three years of incident history, an actual exported file. Then state in the RFP instructions that "Met" with no attachment is treated as no response. A requirement with no evidence attached is not a requirement, it is a wish.

How do you verify a vendor's operating scale?

"Used by many large enterprises" is not a verifiable statement. Ask for the largest learner count for a single customer, and write in the RFP that the sum of all customers will not be accepted. For load tests, take the test conditions (tooling, scenario, date of measurement, infrastructure) alongside the number, and state in the requirement that the figure is not a guaranteed steady-state capacity. TouchClass submits a largest single customer of 39,000 learners and an 18,000-concurrent load-test result (not a guaranteed steady-state capacity), as a published document.

Where do AI requirements go in an LMS RFP?

In their own chapter — never blended into the general functional requirements. Write "does it have AI" as one functional line and the answer comes back "yes, supported", with the controls, the evidence and the cost model all missing. AI runs on a different axis: data → control → validation. Lift the 8 AI control requirements (exclusion from model training, blocking external transmission, call-scope limits, input/output validation, source attribution, audit logging, export and deletion evidence, permission-based output control) and the AI RFP steps from the document that already carries them.

Where do data export and interoperability standards belong?

In both the integration requirements (54–55) and the termination requirement (60). If learning data only ever lands in a vendor's proprietary format, changing platform erases years of learning history. Treat export format, schema and lead time as contract items, and make bidders state their coverage of the interoperability standards (xAPI, LTI, Open Badges 3.0, CLR 2.0). The requirement wording and the checks for each standard are tabulated in this document.

Does TouchClass meet all 60 requirements?

No. Three of them are answered conditionally. On 35, skills graph: interest-keyword curation is supported, but a structured role-and-competency graph requires separate design work. On 43, separation of AI output from high-stakes HR decisions: the features exist, but separating them from promotion, appraisal and compensation needs the customer's own policy, approval path and audit structure. On 53, capture prevention: capture logging and masking are supported, but on iOS complete blocking is not claimed, as it is an OS-level constraint. All three are published as they are — a proposal with no conditional responses at all is the one worth a second look.

How does this page differ from the LMS comparison checklist?

Same 60 items, opposite direction. This page is the specification you demand of bidders (requirement level, evidence, verification method). The LMS comparison checklist is the table you evaluate them with (how to verify, owner, rating scale). Before the RFP goes out, read this page; once proposals arrive and you are running demos, read the checklist. The item numbers match, so an RFP response drops straight into the comparison table.

Procurement, comparison and diagnosis are different stages. Go to the document that matches where you are.

Proposals in hand

Turn responses into a comparison table

The same 60 items on a rating scale (◎ ○ △ ×). Read the gaps in the P1 items, not the total score.

Before the RFP

Decide what to demand in the first place

Eight selection criteria: security, real usage, authoring capacity, compliance automation, scale, TCO, integration, proven operating scale.

Set expectations

The baseline to hold vendors to

107 companies, 35 months of operating logs. Median MAU for non-mandatory training: 23% (n=75). Demand a distribution at this resolution.

How to write an LMS RFP

RFPs fail because each bidder is asked a different question

The 8 steps of an LMS RFP

1. State the scope of the procurement in one sentence −

2. Attach your as-is inventory to the RFP +

3. Split the requirements into Must, Should and May +

4. Name the evidence — down to the document +

5. Fix the verification method yourself, in advance +

6. Publish the scoring and the disqualification rule +

7. Take the pricing as a three-year TCO +

8. Demand the exit terms at RFP stage +