Cybersecurity Criteria in Procurement Process for IHLs' Learning Management Systems

Name and Constituency of Member of Parliament

Mr Chua Kheng Wee Louis, Sengkang GRC

Question

To ask the Minister for Education (a) whether the Government is able to share the cybersecurity criteria adopted by IHLs during the procurement process for learning management systems (LMS) developed by third-party vendors; and (b) whether the Government will encourage the IHLs to reassess these criteria in light of the data breach of Instructure’s Canvas LMS in April 2026.

Response

1. MOE issues guidelines on cybersecurity standards for IHL’s IT systems, including Learning Management Systems, which IHLs are required to abide by. These include engaging only LMS vendors that hold industry recognised certifications such as ISO27001 and ISO27018 for information security management and cloud service providers, and complying with data protection obligations under the Personal Data Protection Act 2012.
2. MOE will continue to review and update its cybersecurity guidance to IHLs regularly, in light of evolving cybersecurity threats and lessons learnt from incidents.