rfp lms managed service for the nc education cloud no. 40 … · 2019-08-15 · rfp lms managed...

Response to:

RFP LMS Managed Service for the NC Education Cloud No.

40-IT00103-14

State of North Carolina Dept of

Public Instruction (NCDPI)

Submitted by:

Instructure, Inc. 11 September 2014

Instructure 6330 South 3000 East Suite 700 Salt Lake City ● Utah 84121

State of North Carolina Dept of Public Instruction RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14

11 September 2014

State of North Carolina Dept of Public Instruction

Mr. Mike Beaver [email protected]

Dear Mr. Beaver:

Instructure is pleased to respond to State of North Carolina Dept of Public Instruction’s RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14.

Canvas is designed to help NCDPI transform education by providing a single, integrated learning management system (LMS) that bundles assessments, grading, standards tracking, messaging, learning analytics, and more—while keeping everything simple, easy, and in one place.

Over 400 K-12 institutions have chosen Canvas for their LMS because of the usability and power of Canvas’s teaching and learning toolset and Instructure’s innovative corporate vision and strong client support services. The Canvas platform has been adopted by K-12 education organizations like Clark County School District (the 5th largest district in the USA), Rock Hill School District, and Pasco County School District.

Instructure is confident that a successful Canvas deployment at the state level will produce interest at the schools so we are offering 100,000 licenses complimentary to the state for Professional Development purposes and 50,000 for use within the Virtual Public School. Implementation fees would apply only.

If you have any questions or require additional information, please feel free to contact me.

Sincerely,

Melissa Gomez K-12 Regional Director of the Mid-Atlantic Region

[email protected] P:+1. 801.869.5010 C: +1.801.678.3021 FX: 888.213.3894

6330 South 3000 East, Suite 700 Salt Lake City, Utah 84121 800.203.6755

State of North Carolina Dept of Public Instruction Volume I Technical Capability RFP LMS Managed Service for the NC Education

Cloud No. 40-IT00103-14

1 Letter of Transmittal

11 September 2014

State of North Carolina Dept of Public Instruction

Mr. Mike Beaver [email protected]

Dear Mr. Beaver:

Instructure is pleased to respond to State of North Carolina Dept of Public Instruction’s RFP LMS Managed Service for the NC Education Cloud No. 40-IT00103-14.

Instructure understands the work to be done, has the ability to meet the requirements of the RFP, and is commited to performing the work within the specified parameters.

1.1 Submitting Organization

Table 1 Instructure Contact Information

Legal Business Name

Instructure, Inc.

Address, Phone, and Fax Number

6330 South 3000 East Suite 700 Salt Lake City, Utah 84121 Phone: 800.203.6755 Fax: 888.213.3894

Primary Contact and Contact for

Clarifications

Melissa Gomez K-12 Regional Sales Director [email protected] Phone: 801.678.3021

Contact with Negotiation and

Contractual Authorization

Jonathan Cook Controller [email protected] 801.869.5208

1.2 RFP Amendments

Instructure did receive an addendum to the Request for Bid #: #40-IT00103-14 and the signed addendum is included on the following page.

mailto:[email protected]

Instructure 6330 South 3000 East Suite 700 Salt Lake City ● Utah 84121


We appreciate this opportunity to tell you about Canvas and our hosting and support services. If you have any questions or require additional information, please feel free to contact me.

Sincerely,

Melissa Gomez K-12 Regional Director of the Mid-Atlantic Region

[email protected] P:+1. 801.869.5010 C: +1.801.678.3021 FX: 888.213.3894

11 September 2014 Instructure, Inc. i


Table of Contents

1 Letter of Transmittal ........................................................................................................................... i

1.1 Submitting Organization .......................................................................................................... i

1.2 RFP Amendments ................................................................................................................... i

2 Proposal Summary ........................................................................................................................... 6

2.1 What Makes Us Stand Apart: .................................................................................................. 7

2.1.1 Easy to Use .............................................................................................................. 7

2.1.2 Adaptable ................................................................................................................. 7

2.1.3 Availability ................................................................................................................ 8

2.1.4 Canvas Overview ..................................................................................................... 8

3 Response to Technical Requirements/Sprecifications..................................................................... 12

1.1.1 View Activity ........................................................................................................... 39

1.1.2 View Communication.............................................................................................. 39

1.1.3 View Assignments .................................................................................................. 40

1.1.4 View Grades .......................................................................................................... 40

3.1 LMS Desirable Features ....................................................................................................... 98

4 References ................................................................................................................................... 101

5 Financial Information..................................................................................................................... 104

6 Cost Proposal ............................................................................................................................... 105

6.1 Canvas Subscription Fee Inclusions ................................................................................... 106

6.2 Canvas Implementation Service Package ........................................................................... 106

6.3 Canvas Training Offerings .................................................................................................. 108

6.4 Canvas Support Packages ................................................................................................. 108

6.5 Canvas Tier I Support ......................................................................................................... 110

7 Conflict of Interest ......................................................................................................................... 116

8 Vendor’s Additional Terms and Conditions ................................................................................... 117

9 Errata and Exceptions ................................................................................................................... 118

10 Copy of Vendor’s License and Maintenance Agreements ............................................................ 119

11 Other Supporting Material Including Technical System Documentation ....................................... 120

12 Training and Other Materials, Samples or Examples ................................................................... 121

13 RFP Attachment 6 Responses .................................................................................................... 127

11 September 2014 Instructure, Inc. ii


Instructure’s Terms and Conditions ............................................................................. 143

Appendix B. Master Subscription Services Agreement .................................................................... 145

Appendix C. Disaster Recovery ....................................................................................................... 146

Appendix D. Canvas Security .......................................................................................................... 147

Appendix E. Catalog – Registration and Payment Portal ................................................................. 148

E.1 Features and Functions ...................................................................................................... 148

Appendix F. Signed Forms .............................................................................................................. 153

11 September 2014 Instructure, Inc. iii


Table of Tables

Table 1 Instructure Contact Information ...................................................................................................................... i

Table 2 Canvas K-12 Features .................................................................................................................................. 9

Table 3. Implementation Plan................................................................................................................................... 28

Table 4 Partial List of Third-Party Integrations Support ........................................................................................... 48

Table 5 Canvas Tools for Formative Assessment ................................................................................................... 52

Table 6 Canvas Tools for Summative Assessment ................................................................................................. 53

Table 7 Implementation Risks and Mitigation .......................................................................................................... 84

Table 8 Premium Support Package ......................................................................................................................... 86

Table 9 Instructure Tier I Support Costs .................................................................................................................. 87

Table 10 Instructure Tier I Support Service Levels .................................................................................................. 88

Table 11 Support Metrics ......................................................................................................................................... 89

Table 12. Reference: Knox County Schools .......................................................................................................... 101

Table 13. Reference: Rock Hill School District 3 ................................................................................................... 101

Table 14. Reference: Rockingham County Schools ............................................................................................. 102

Table 15. Reference: Utah Educational Network ................................................................................................... 102

Table 16. Reference: Katy ISD – Virtual School .................................................................................................... 103

Table 17. Canvas Subscription Inclusions Breakout .............................................................................................. 106

Table 18. Canvas Implementation Services Packages .......................................................................................... 106

Table 19. Canvas Implementation Services Package: Services, Duration, and Price........................................... 107

Table 20. Canvas Support Packages ..................................................................................................................... 110

Table 21. Canvas Tier I Support Service Levels .................................................................................................... 111

Table 22. Canvas Premium Implementation Service Package .............................................................................. 111

Table 23. Canvas Premium Implementation Service Package: Service, and Duration ......................................... 112

Table 24. Current LEAs or Charter School Customers .......................................................................................... 115

Table 25. Canvas Training Offerings Menu ........................................................................................................... 121

11 September 2014 Instructure, Inc. iv


Table of Figures

Figure 1 K-12 Adoption Rates .................................................................................................................................... 7

Figure 2. Permissions interface of the Administrator’s Settings tool. ....................................................................... 16

Figure 3. Enabling, Disabling, Locking Permissions ................................................................................................ 17

Figure 4. Example of a Canvas Product Release Note ........................................................................................... 19

Figure 5. Canvas Architecture .................................................................................................................................. 22

Figure 6. Canvas by Instructure for iOS. .................................................................................................................. 31

Figure 7. Canvas by Instructure for Android. ........................................................................................................... 31

Figure 8 SpeedGrader for iPad ................................................................................................................................ 32

Figure 9. Import Content processed jobs. ................................................................................................................ 35

Figure 10. Canvas Analytics: Course View .............................................................................................................. 38

Figure 11. Analytics Course View: Student Section ................................................................................................. 38

Figure 12. Student Summary Information ................................................................................................................ 39

Figure 13. View Activity ............................................................................................................................................ 39

Figure 14. View Communication .............................................................................................................................. 39

Figure 15. View Assignments ................................................................................................................................... 40

Figure 16. View Grades ............................................................................................................................................ 40

Figure 17. Faculty View: Gradebook ........................................................................................................................ 42

Figure 18. Curve Grades Feature in the Gradebook ............................................................................................... 43

Figure 19. Course Modules ...................................................................................................................................... 43

Figure 20. Canvas Collaborations interface. ............................................................................................................ 47

Figure 21. Peer Review Notification ......................................................................................................................... 48

Figure 22 Annotating, highlighting, and commenting on submissions. .................................................................... 52

Figure 23 Quizzes tool interface. ............................................................................................................................. 55

Figure 24 Quizzes tool: interactive scoring and feedback. ...................................................................................... 55

Figure 25 Moderate Quiz interface. .......................................................................................................................... 56

Figure 26 Selective release of course coursework/content. .................................................................................... 57

Figure 27. Create a Question Group ........................................................................................................................ 57

Figure 28 Canvas Quizzes: Quiz Statistics Redundancy and Failover .................................................................... 59

Figure 29 Canvas Conversations interface. ............................................................................................................. 60

Figure 32 Canvas Discussions ................................................................................................................................. 61

Figure 33 Canvas Discussions interface. ................................................................................................................. 62

Figure 34 Discussion Creation Tool ......................................................................................................................... 63

Figure 35 Discussion Settings .................................................................................................................................. 64

Figure 36 Masquerading as a user. ......................................................................................................................... 65

11 September 2014 Instructure, Inc. v


Figure 37 Students Can Opt Into Receiving Grades Notifications in their Account Settings ................................... 66

Figure 38 ePortfolio tool. .......................................................................................................................................... 68

Figure 39 Canvas ePortfolio Example #1 ................................................................................................................. 69

Figure 40 Canvas ePortfolio Example #2 ................................................................................................................. 69

Figure 41. Rich Content Editor Interface .................................................................................................................. 70

Figure 42 Teacher View of Gradebook .................................................................................................................... 71

Figure 43 Weighting the Final Grade ....................................................................................................................... 72

Figure 44 Alerts Interface ......................................................................................................................................... 73

Figure 45 Annotating, highlighting, and commenting on submissions. .................................................................... 75

Figure 46 Student Gradebook View ......................................................................................................................... 76

Figure 47 Learning Mastery Gradebook Interface ................................................................................................... 78

Figure 48 Outcome Breakdown Percentages .......................................................................................................... 78

Figure 49 Filtering the Learning Mastery Gradebook .............................................................................................. 79

Figure 50 Viewing Outcome Statistics by Course Average, Median, or Mode ........................................................ 79

Figure 51 Mastery Gradebook: Individual View ....................................................................................................... 80

Figure 52 User role permissions interface of Canvas Administrator’s dashboard. .................................................. 82

Figure 53 Canvas Modules. ..................................................................................................................................... 93

Figure 54 Selective release of course modules ....................................................................................................... 94

Figure 55 Specifying Module prerequisite and completion criteria. ......................................................................... 95

Figure 56 Module progress by student. .................................................................................................................... 96

Figure 57 User reports in the course People tool..................................................................................................... 96

Figure 58 Rich Content Editor Interface ................................................................................................................... 97

Figure 59. Canvas Conferences Interface ............................................................................................................... 99

Figure 60. Canvas Chat Interface .......................................................................................................................... 100

Figure 61. Canvas Help Center. ............................................................................................................................. 120

Figure 62. Catalog’s Custom Branded Site ............................................................................................................ 148

11 September 2014 Instructure, Inc. 6


2 Proposal Summary

A proposal summary may be included by Vendors to provide the Evaluation Committee with an overview of the technical and business features of the proposal; however, this material will not be used in the evaluation process unless specifically referenced from other portions of the Vendor’s

proposal

The NCPDI has a reputation for excellence and innovation in education. The creation of the North Carolina Virtual Public School (NCVPS) set North Carolina apart for seeing the value in incorporating technology into education. Moving forward with a student population of close to 1.3 million, NCPDI needs to ensure that they have a strong partner in order to create a virtual learning environment that is intuitive enough to ensure high adoption rates, that is adaptive enough to meet the changing needs of the students of North Carolina, and that is reliable enough to ensure that availability is virtually unlimited.

Canvas provides a robust learning management system that offers the foundation to create rich engaging asynchronous and synchronous learning opportunities to meet the needs of student-only online mastery courses, instructor-led online courses and instructor-led courses in classroom environments. Canvas offers the critical integration with the statewide Student Information system (SIS)-Pearson PowerSchool, the statewide Learning Object Repository (NCLOR), and the statewide Identity and Access Management Service (IAMS) for K-12 educators. Canvas offers an unparalleled 24/7/365 service option to ensure that we are helping you meet your student’s needs. Most importantly, we define availability with our 99.9% uptime.

Canvas will provide the support you need to ensure that the Standard Course of Study is integrated into the curriculum. Canvas Learning Outcomes allow you to effortlessly integrate learning outcomes into every part of the course from the assignments to the assessments to the portfolio. When creating an assignment or assessment, you can insert Learning Outcomes into the rubric so that when instructors are grading an assignment, they are also providing data about student mastery. Learning Outcomes can simplify tracking within schools and across the entire state.

We would love to have the opportunity to show you what Canvas has to offer as you move forward toward your vision of “every public school student will graduate from high school, globally competitive for work and postsecondary education and prepared for life in the 21st Century.” Our technology, hosting, and tools will provide a solid foundation to support you as you continue to innovate and revolutionize online education. We would be honored to be your partner in improving the lives of the students of North Carolina and preparing them for success.



2.1 What Makes Us Stand Apart:

2.1.1 Easy to Use

Areas in which Canvas stands out from other LMS systems include a native IOS course app that is designed to make access to Canvas on mobile devices as simple as possible. Students want their course information in the format that they actually use and that is most readily available to them. That is why Canvas offers a Native iOS course app and a Native Android course app. Canvas also offers a native mobile polling app. Ensuring that Canvas is easily available helps ensure that it gets used and utilized. The intuitive nature of Canvas has led to extremely high faculty adoption rates, as shown in Figure 1.

Figure 1 K-12 Adoption Rates

Canvas is designed thoughtfully and deliberately to be exceptionally easy to use with an elegant and intuitive interface. Our goal is to have students access information in the fewest clicks possible. Students, especially young students, can get frustrated when they cannot find the information they need. Canvas’s dashboard shows students the most important information right when they log in. The Dashboard answers the questions, "What is going on in all of my courses?" and "What do I need to do next?" The dashboard provides a single view that allows students to view assignments, course materials, and grades, as well as upload materials and submit assignments. This single view ensures that students can quickly and easily find the information they need so that they can focus on learning.

2.1.2 Adaptable

Canvas strives to be adaptable to meet the needs of schools and universities around the world. Each institution has unique needs. We want YOU to be able to find the solution that fits your exact needs.



Part of making that happen is having an open API to ensure that applications can be easily integrated into Canvas. Something that sets us apart in the LMS industry is our one-click LTI installation. The Canvas Edu App Center (https://www.eduappcenter.com/) is a rapidly-growing app library with over 130 apps providing interactive resources, content repositories, assessment tools, social media, and other digital learning and teaching resources.

Canvas also lends itself to customization. Canvas does not expect you to modify your course content to conform to a rigid course template or to fit into a pre-determined course organization. Merely inserting course content into premade molds does not create the best educational opportunities. Canvas provides you the tools and freedom to innovate and create courses that fit your students’ unique needs as well as your pedagogical goals.

Instructure believes that Canvas should empower teaching and learning without burdening teachers and students. Technology is a tool of education, and if we do our work right Canvas, first, stays out of the way, and, second, encourages teachers and learners to innovate and improve their practice. We want to ensure that we are constantly evolving to meet the needs of our clients. For this reason, every client has the opportunity to discuss improvements and changes with an assigned Customer Success Manager.

2.1.3 Availability

Availability and access are another critical aspect of a virtual learning environment. If you create an engaging, intuitive learning environment, but the system is frequently down, you will have students who are unable to access the rich experience that you have created. Canvas knows that availability is critical; that is why we guarantee an unparalleled 99.9% uptime. When we install updates, we do our best to ensure that your system remains up. We also install updates on days that are typically less busy, like a late Saturday afternoon.

Canvas is the only LMS hosted on a native cloud. This means that you will never have to do another update or worry about versions. All updates are hands-free, meaning you don’t have to do a thing. Canvas also offers automated provisioning to ensure that system availability is always high. If we get a spike, we take advantage of the native cloud to make sure that everything is evenly distributed so that your students don’t experience slower service. Finally, Canvas has an open API. We want to make it easy for you to integrate with other software, programs, and services that will optimize your system.

2.1.4 Canvas Overview

Canvas K-12 is a single, integrated learning management platform that bundles assessments, grading, state standards tracking, messaging, learning analytics, and more, while keeping everything simple and in one place.

Canvas K-12 can be accessed from anywhere at any time, helping teachers engage students, and allowing parents to co-enroll in classes to track assignments and grades. Because Canvas K-12 requires no programming knowledge, teachers can easily create, manage, and reuse course content.

https://www.eduappcenter.com/



Usually teachers, administrators, students, and parents already have the skills needed to navigate, learn, and use Canvas K-12.

Canvas K-12 is hosted by Instructure on the Amazon Elastic Compute Cloud (EC2) and uses the fully redundant storage resources of the Amazon Simple Storage Service (S3). Canvas K-12 can be accessed from any computing or communications device with Internet connectivity and a compatible web browser, including tablets and smart phones. Canvas guarantees 99.9% system availability and provides full support, rolling updates with no downtime, backups, and data recovery.

Table 2 includes a sampling of Canvas K-12 features.

Table 2 Canvas K-12 Features

Canvas K-12 Features

Accessibility Canvas K-12 complies with accessibility standards and is suitable for teachers and students of all abilities.

Flexible Pedagogy A variety of teaching styles, frameworks, and Web technologies are supported.

Parent Co-enrollment Parents can be co-enrolled with students to monitor assignments, grades, missing work, and teacher communication.

Learning Analytics Teachers, administrators, and parents can monitor student engagement, track activities, and use predictive profiles to help at-risk students.

Standards Reporting Objectives for state standards can be aligned with course assessments for easy standards reporting.

Integrated Calendar Calendar events are scheduled and rescheduled with drag-and-drop functionality, plus automatic event notifications.

Rich Content Editor Video, audio, images, tables, math formulas, and URL links can be embedded easily into course content.

Assignments Submission formats include web pages, Word docs, video, audio, slide shows, and more.

Online Testing Quizzes can be created from scratch or from question banks with a variety of question types and quiz options.




Rubrics Created from sets of teacher-defined criteria, rubrics provide a structured, consistent, and prescriptive framework for assessment.

Learning Mastery Gradebook

Helps faculty and administrators tracks standards and assess the outcomes that are being used in Canvas courses

Learning Outcomes Learning outcomes can be aligned to rubrics for institution-wide initiatives such as accreditation.

MagicMarker for iPad Enables instructors to mark student progress toward learning outcomes quickly, easily, and in real-time in fast-moving classrooms

Polls for Canvas Student response app (for iOS and Android) for real-time and on-the-fly classroom polling

SpeedGrader™ Teachers can view, grade, initiate discussions, and provide students with written, video, or audio feedback within one frame.

Grades Assignments and quizzes can be scored by points, percentages, letter grades, and complete/incomplete.

Groups Ad-hoc groups allow users to form communities based on teacher assignment or self-signup for collaborations, clubs, or interest groups.

Chat Synchronous audio, video, and text chat adds an extra dimension to the learning experience.

Communication Preferences

Users can opt to receive brokered notifications and messages via email, text message, Facebook, or Twitter.

Mobile Access

Courses are accessible from browser-enabled mobile devices and using Canvas mobile apps. Apps are available for the iPhone, iPad, and Android, and can be downloaded from the app store at no charge.

Internationalization Supports English, Spanish, Russian, French, Portuguese (Portuguese Brazil), Japanese, Chinese (Simplified), Arabic, with German and Polish on the near-term product roadmap

Integrations The standards-based, pluggable platform provides easy integration with a wide variety of external technologies, systems, tools, and services.




Security Independent security audits are scheduled annually and results are released publicly.

Canvas Help Center The Web-based support center and knowledgebase includes links to Canvas Guides, video tutorials, FAQs, user-groups, and release notes.



3 Response to Technical Requirements/Sprecifications

Vendor response shall be in the format below. Vendor shall acknowledge their proposed service meets each requirements or specification, and address each item in detail in their RFP response, numbered and in the same order listed, with narratives and examples of how they will satisfy the requirement/specification.

a) Vendor shall ensure that 90% of transactions occur in 3 seconds or less and 95% of transactions occur in 2 seconds or less. The Vendor shall describe how they will monitor and report.

The Canvas cloud architecture—built on Amazon Web Services infrastructure—provides unmatched availability, scalability, and reliability. The Canvas architecture and the AWS infrastructure are fully horizontally scalable providing virtually limitless capacity via the provisioning of additional resources. Instructure’s Master Subscription Services Agreement guarantees 99.9% uptime and we utilize the following best-of-breed solutions to ensure optimal transaction time and page loads:

• Redundancy of computing resources with active monitoring for failure detection and automated fail-over

• Real-time performance tuning via Automated Provisioning of resources to respond to spikes and peak usage times to minimize performance degradation

• Data protection through data replication, backup/restore, and disaster recovery procedures

• Load balanced application servers and aggressive data caching for superior web performance

• Rolling release schedule of upgrades and updates, rarely incurring system downtime

b) The Vendor shall provide real-time monitoring with analytics (graphical and reports).

Canvas provides real-time system monitoring of system availability, database space available, network, and infrastructure. Instructure continually monitors usage, system health, and security of Canvas. Instructure uses a combination of internal and external monitoring systems for maximum coverage, such as Zabbix, pingdom, and pagerduty, as well as some custom systems. This is in addition to "monitoring" that may be thought of simply as user logging and regular internal and external security audits.

c) The LMS service shall scale to at least 30 thousand subscribers in year 1 and allow a scalability of up to 1.5 million subscribers over 4 years. The Vendor shall describe how the service will scale to 1.5 million subscribers and how it will handle variable concurrency as more classrooms move to a device per child.

The Canvas architecture and the AWS infrastructure are fully horizontally scalable providing virtually limitless capacity via the provisioning of additional resources. Currently, the Canvas user base is approximately 14 million users worldwide. Horizontal scalability enables Canvas to respond to usage



spikes in real-time and to accommodate expanded, long-term usage. The Canvas "stack" is a dynamic scaling web application built with our own automated scaling and automated provisioning technology.

Canvas was selected by Cisco Networking Academy to power the “world’s largest classroom” (over 1 million students from 65 different countries). Cisco joins over 900 school districts, universities, and colleges that have chosen Canvas as a learning partner.

One highlight of our hosting is the use of automated provisioning. Application servers are constantly monitored individually for load and capacity information. When all application servers read a certain load threshold, a new application is automatically provisioned and deployed. The Instructure operations team also has the ability to schedule new application servers in advance in anticipation of high load times, such as during the beginning and ends of semesters. For larger partners we may, depending on size and performance requirements, dedicate application servers for specific clients.

Automated provisioning makes the most efficient use of computing resources through the early detection and accommodation of usage spikes. When a spike is detected, server power is allocated among multiple servers to ensure efficient operations even during peak usage times such as at the start and end of academic terms. See Figure 5 for an example.

Without automated provisioning, resources have to be scaled to provide sufficient capacity for times of peak usage. However, that extra capacity is largely wasted during the bulk of the year since peak usage only occurs at particular times, at the start of a school semester, for example. If, on the other hand, resources are scaled to average usage, peak usage times are then under-served and results in frustrated users. This dilemma is eliminated with automated provisioning. Automatic provisioning eliminates the costs of extra capacity while ensuring that sufficient resources are always available when needed.

Figure 5. Instructure’s Automated Provisioning



d) The Vendor shall have full weekly backups with incremental daily backups. The Vendor shall provide for a 48-hour recovery from the loss of a data center including the loss of only 2 hours of data. The Vendor shall describe their disaster recovery plan.

The Canvas platform has been architected to achieve an exceptionally low Recovery Time Objective (RTO) and Recovery Point Objective (RPO). The goal for a disaster scenario for both RPO is 4 hours and RTO is 24 hours. This RPO and RTO, as well as other RPO and RTO estimates provided in this plan, are extremely conservative upper-end estimates. In actual practice, the Operations team expects much lower RPO and RTO times.

Instructor, student, course, assignment database data is replicated asynchronously in near real-time to a remote site. Nightly backups of every database are stored in third remote site. Static assets from courses and assignments such as documents and other content files are stored on a scalable, protected, geographically redundant storage system (Amazon S3). Multiple copies are stored by Instructure which provide the backups.

Full details on Instructure’s disaster recovery plan is available in State of North Carolina Dept of Public Instruction

e) The Vendor shall describe their hosting environment, including primary site location(s) and disaster recovery location(s), internet connectivity, power management and site security. Vendor shall describe the relationship between the primary site(s) and recovery site(s) and any industry certifications that these facilities have achieved (e.g. Tier III/IV, SAS70, SOC1, SOC2, etc.). If the hosting facilities are SAS 70 II compliant and/or compliant with SSAE 15 reporting standards, the Vendor shall include a copy of the most recent audit. If the Vendor’s LMS service is hosted by a third party, the Vendor shall provide details of that hosting agreement.

Canvas Cloud is hosted on Amazon Web Services’ cloud infrastructure. Amazon EC2 is currently available in seven regions: US East (Northern Virginia), US West (Oregon), US West (Northern California, and AWS GovCloud.

Canvas security is ensured on the Amazon Web Services’ Elastic Compute Cloud (EC2) and Simple Storage Service (Amazon S3). Amazon Web Services (AWS) has successfully completed multiple SAS70 Type II audits, and as of September 30, 2011 publishes a Service Organization Controls 1 (SOC 1) report, published under both the SSAE 16 and the ISAE 3402 professional standards. In addition, AWS has achieved ISO 27001 certification, has been successfully validated as a Level 1 service provider under the Payment Card Industry (PCI) Data Security Standard (DSS), and has completed the control implementation and independent security testing required to operate at the FISMA-Moderate level. AWS continues to obtain the appropriate security certifications and conduct audits to demonstrate the security of its infrastructure and services.

AWS datacenters are housed in undisclosed facilities. Physical access is strictly controlled both at the perimeter and at building ingress points by professional security staff utilizing video surveillance,



intrusion detection systems, and other electronic means. Authorized staff must pass two-factor authentication a minimum of two times to access datacenter floors. All visitors and contractors are required to present identification and are signed in and continually escorted by authorized staff.

AWS only provides datacenter access and information to employees and contractors who have a legitimate business need for such privileges. All physical access to datacenters by AWS employees is logged and audited routinely.

f) The Vendor shall describe the architectural approach, infrastructure and operating environments that are necessary to meet the stated recovery point and time objectives. In addition tell us if the proposed solution exceeds those metrics.

Please refer to Appendix C “Disaster Recovery Procedures and Plan.”

g) Vendor shall describe their data archival policies and any data purge policies.

Canvas maintains all historical data in the Amazon cloud infrastructure; archiving or purging any content is typically unnecessary. However, the Content Copy tool and Course Export tool can be used to archive course content if desired.

h) The Vendor shall ensure that all data processed, stored and maintained in the LMS service shall NOT leave the borders of the United States. This shall include all online storage as well as data backups and archived data.

Yes, Instructure ensures that data from NCDPI will be processed, stored and maintained in the United States, including online storage and data backups and archived data.

i) The State retains the right to audit the physical environment where a service is hosted per the vendor proposal. The Vendor shall describe the processes in place to allow this audit.

Canvas is hosted on Amazon Web Services and we would need to get permission from AWS to have NCDPI audit the physical environment. We currently do not have a process in place to audit AWS sites.

j) The Vendor shall describe their process for employee background checks. Please include who performs them, for which employees, and when the checks are performed.

All employees are required to under go a background check. In addition, Canvas complies with U.S. federal law regarding Family Educational Rights Privacy Act (FERPA) and Children's Online Privacy Protection Act (COPPA) and gives schools the tools they need to maintain compliance. All employees sign a CIPA agreement.

k) The Vendor shall describe the process for handling non-public data at rest and non-public data in motion.

Canvas is entirely at least 128-bit SSL-protected, ensuring that both inbound and outbound traffic, including any sensitive or personally-identifiable information is encrypted and secured. Canvas does not encrypt for data at rest.



Canvas provides a consistent, end-to-end security infrastructure responsible for protecting all content provided in and through the Canvas system. Access to user information, courses, course content, files, and more is restricted by enrollment type and specific permissions. These permissions are fully configurable by the institution's administrators and can differ between districts, schools, and other levels of institutional hierarchy.

l) The Vendor shall describe the process for handling and notification of a breach of non-public data.

Please refer to Appendix D “Canvas Security” for our handling of notification of a security breach.

m) The Vendor shall describe the handling of authorization for the various roles associated with data access.

Access to Canvas information, features, and functionality is controlled by user authentication, user accounts, and user roles. Canvas provides six predefined Canvas user roles with default permissions—Admins (Canvas Administrators), Teachers, TAs (Teaching Assistants), Designers (Course Designers), Students, and Observers/Parents. Institutions can modify the permissions of the predefined user roles as well as create new user roles as needed.

Canvas provides a fine level of granularity of user-role based access control with over 70 account and course-level permissions. A portion of the Permissions interface in the Canvas Administrator’s account Settings tool is shown in Figure 2.

Figure 2. Permissions interface of the Administrator’s Settings tool.



Account Administrators are “super-users” with all permissions granted at the account and course levels. Administrators can be restricted to sub-accounts with full administrative permissions limited to the sub-account and the constituent courses. The “Manage permissions” permission allows that user role to enable and disable (and optionally lock the setting) the permissions of other user roles as shown in Figure 3.

Figure 3. Enabling, Disabling, Locking Permissions

n) The Vendor shall only allow remote access using industry standard network security processes. The Vendor shall describe their processes.

Canvas supports centralized identity management and delegated authentication via integrations with external identity providers (IdPs) including Lightweight Directory Access Protocol (LDAP), Active Directory, Central Authentication Service (CAS), Security Assertion Markup Language (SAML) 2.0, and Shibboleth. Canvas supports federated identity management and Single Sign-On (SSO) via integrations with SAML, Shibboleth, and CAS. Additionally, user ID and password credentials from any third-party system can be synchronized with Canvas-internal, local authentication via the Canvas open API.

Canvas-internal authentication can be used alone or concurrently with any of the supported external IdPs identified above. For example, when used concurrently with LDAP Canvas first presents user credentials to the external IdP. If authentication fails, Canvas then looks up the credentials using its internal authentication service. If authentication fails again, Canvas will deny the user login.

o) The Vendor shall describe security of data stored at the vendor’s site as well as any server security policies. The service shall have undergone vulnerability and penetration testing.

Canvas is housed in Amazon Web Services, which meets the District’s minimum requirements for information security. Amazon Web Services’ network security protects against:



• Distributed Denial Of Service (DDoS) Attacks - Proprietary DDoS mitigation techniques are used. Additionally, AWS’s networks are multi-homed across a number of providers to achieve Internet access diversity.

• Man In the Middle (MITM) Attacks - All of the AWS APIs are available via SSL-protected endpoints which provide server authentication. Amazon EC2 Amazon Machine Images (AMIs)

• Automatically generate new Secure Shell (SSH) host certificates on first boot and log them to the instance’s console. For data security, all Canvas data is transferred over an SSL-encrypted connection through HTTPS. Canvas Cloud Edition encrypts all traffic with 128-bit SSL all the time over Amazon S3 and EC2 servers.

• IP Spoofing - Amazon EC2 instances cannot send spoofed network traffic. The AWS-controlled, host-based firewall infrastructure will not permit an instance to send traffic with a source IP or MAC address other than its own.

• Port Scanning - Unauthorized port scans by Amazon EC2 customers are a violation of the AWS Acceptable Use Policy.

• Packet Sniffing - It is not possible for a virtual instance running in promiscuous mode to receive or “sniff” traffic that is intended for a different virtual instance.

Extensive information about AWS network layer security can be found at http://aws.amazon.com/security/ and in the Amazon Web Services: Overview of Security Processes Whitepaper.

p) The Vendor shall describe the level of customer control on applying patches, upgrades, and changes to the SaaS application and the notification process to be used.

Canvas is implemented as a true cloud-based LMS which is incrementally upgraded and updated on an ongoing basis; there are no major releases in the traditional sense. Instructure does not assign version numbers to any particular point-in-time implementation of Canvas. By definition and by virtue of the cloud implementation model, our client institutions simply access and use the current production implementation of Canvas.

Canvas “Hands-Free” upgrades and updates are part of Instructure’s comprehensive hosting services and are included in the annual Canvas subscription fees. Instructure upgrades and updates Canvas on a tri-weekly cycle, so that client institutions benefit from continuous product improvement, new features, and extended functionality. Upgrade and updates are typically released to the Canvas production environment every third Saturday morning. As warranted, Instructure will apply security-related bug fixes between the tri-weekly upgrade/update releases. Instructure’s rolling release methodology rarely incurs any system downtime.

Instructure emails detailed release notes to institutions’ Canvas administrators in advance of the release date (when the release package is deployed to the beta environment) describing the new features, modified features, and/or bug fixes included in the release package as well as indicating if any downtime is expected when the release is deployed.



Upgrades and updates are first deployed to Canvas beta environment prior to being implemented in the production environment. All client institutions have access to the beta environment where users can test drive and provide feedback about the upcoming/proposed changes.

With these agile development methodologies, Instructure is still sensitive to the needs of admins and IT. Most changes are subtle and all changes come with proper amount of warning and often will include an opt-in or opt-out aspect to larger development updates.

Detailed release notes are emailed to institutions’ Canvas administrators. General release notes and screencasts are provided in the Canvas Community Product Forum in the Canvas Help Center at https://help.instructure.com/forums/337224-product-release-notes. A screenshot of a portion of the most recent Canvas product release note is shown in Figure 4.

Figure 4. Example of a Canvas Product Release Note

q) The Vendor shall describe the process for handling software defects.

Canvas applies an agile methodology with an integrated QA process to the design, development, and maintenance of Canvas. The QA process certifies product functionality, reliability, and accessibility. Every day during the three-week cycle, Canvas’s engineering team holds a “stand-up” meeting to review progress and discuss any concerns. Engineers write automated unit and integration tests to cover all new code that is written. In addition, all code changes are run through the full Canvas QA test suite before they can be accepted into the main product. Code changes are closely reviewed and must be peer-approved by other engineering team members before inclusion in the upgrade/update package.

https://help.instructure.com/forums/337224-product-release-notes



After the three-week development cycle, all changes are deployed to an internal staging server for additional QA testing. Canvas’s QA team reviews all associated tickets, uses black box testing of affected components, and also test standard application workflows. Notes are made on the internal tickets for these changes as needed. Any bugs that are found must be fixed during this QA period, otherwise the change is pulled for further development.

Prior to release to the Canvas production environment, all upgrade/update packages are released to a beta environment where the users of our client institutions can test drive and comment on new and changed features and functionality.

Preliminary release notes are generated for the upcoming release and made available to all users at http://help.instructure.com/forums/337224-product-release-notes and updated during the QA process.

Current and past release notes for the tri-weekly Canvas upgrade/update releases are available at http://help.instructure.com/forums/337224-product-release-notes.

• Past security notices for Canvas are available on the Security Advisory Forum of the Canvas Community at https://help.instructure.com/forums/20382721-Security-Notices.

r) The Vendor shall describe the major and minor release policy for the solution.

Please refer to Item p above for information about our agile development and the tri-weekly release cycles.

s) The Vendor shall describe the processes for incident management, change management, and release management.

Please refer to Item q above for a description of the incident management, change management and release management.

t) The Vendor shall describe any user configurable settings.

With the agile development methodologies, Instructure is still sensitive to the needs of admins and IT. Most changes are subtle and all changes come with proper amount of warning and often will include an opt-in or opt-out aspect to larger development updates.

u) The Vendor shall describe the proposed solutions applications architecture.

The Canvas architecture is a single instance, multi-tenant system designed to scale to tens of millions of users. The Canvas "stack" is a dynamic scaling web application built with our own automated scaling and automated provisioning technologies. Canvas is developed using Ruby on Rails built on:

• Ubuntu LTS operating system

• Apache2 + Passenger web and application server

• Cassandra and Redis NoSQL store and caching

http://help.instructure.com/forums/337224-product-release-notes


https://help.instructure.com/forums/20382721-Security-Notices



• PgBouncer and PostgreSQL transactional database

Canvas’s multi-tiered architecture is shown in Figure 5. Canvas is hosted on the state-of-the-technology cloud infrastructure provided by Amazon Web Services (AWS). The AWS services used to host Canvas include Elastic Compute Cloud (EC2), Elastic Load Balancing (ELB), Simple Storage System (S3), Elastic Block Store (EBS), Virtual Private Cloud (VPC), Simple Email Service (SES), CloudFront, Identity and Access Management (IAM), DirectConnect, and CloudSearch. All application nodes are hosted on the AWS EC2 and S3 infrastructure, making full use of the real-time redundancy and capacity capabilities offered. Virtualization is provided by AWS EC2.

All data traffic in and out of Canvas is 128-bit SSL-encrypted. The AWS cloud infrastructure is SAS70 Type II audited, Service Organization Controls 1 (SOC 1) reported and published under both the SSAE 16 and the ISAE 3402 professional standards, ISO 27001 certified, Level 1 service provider under the Payment Card Industry (PCI) Data Security Standard (DSS), and has achieved FISMA-Moderate operation level. Instructure uses three AWS regions: the US East (Northern Virginia) Region with 5 EC2 Availability Zones, the US West (Oregon) Region with 3 EC2 Availability Zones, and the EU West (Ireland) Region with 3 EC2 Availability Zones.

The Canvas architecture is horizontally scalable, enabling it to respond to usage spikes in real-time and to accommodate expanded, long-term usage. Canvas architecture also provides exceptional resilience to and rapid recovery from component failure. The Canvas application, its media and file storage, and its database are each independently redundant. If an application hosting node were to fail, all traffic would transfer to living nodes. If load increases, Canvas's automated provisioning system ensures that more hosting nodes are made available—either in response to increased load or in anticipation of it—to handle it. The database and file stores are also horizontally scalable, adding capacity for both additional storage and load as needed.

The tiers of the Canvas architecture—Load Balancers, Application Servers, Caching, Database, Distributed File Store, and Rich Media Store—are described below.



Figure 5. Canvas Architecture

Load Balancers

Load balancers are deployed in pairs in an active/passive configuration. The active load balancer handles all incoming requests and dispatches the underlying connection to available application servers. The load balancer maintains a dynamic list of available application servers for dispatch.

Approximately every five (5) seconds the load balancer sends a heartbeat—a simple network message—to verify that the application server is still up, available, and capable of receiving additional work. The load balancer does not dispatch work to unresponsive application servers. This list of live application servers is mirrored in near real-time to the passive load balancer. Load balancers are fully monitored for load and potential failure.

Component Failure

The passive load balancer continuously verifies that the primary load balancer is available and servicing requests by sending a heartbeat every second. When the primary load balancer stops responding to heartbeat checks, the passive load balancer:



1. Assumes the IP address of the failed primary load balancer 2. Promotes itself as the primary load balancer by making an API call 3. Sends an alert to the Network Operations Center (NOC)

Capacity

Additional capacity can be added to the load balancing tier when the monitoring system detects load saturation. Load balancers are always added in active/passive pairs to maintain high availability. Additional load balancer pairs are allocated IP addresses, then registered for DNS round-robin lookups.

Updates/patches

Load balancer operating systems are updated regularly with security patches. These are done one at a time, so there is no interruption in servicing clients.

Application Servers

Application servers process incoming requests from the load balancers. They are responsible for executing the business logic, rendering HTML, and returning some static assets to the web browser.

Component Failure

Application servers are constantly monitored by the load balancers via a heartbeat mechanism. When an application server stops responding to heartbeat checks, the load balancer will remove it from the pool of servers to send requests to. The load balancer will keep checking the application server until it starts responding again, at which point it will start sending new traffic.

Application servers do not persist any state, so losing one does not affect the service directly. Because there is no shared state between application servers, it is quick and easy to deploy new ones when necessary.

Capacity

Application servers are constantly monitored individually for load and capacity information. When all application servers read a certain load threshold, a new application is automatically provisioned and deployed. The Instructure operations team also has the ability to schedule new application servers in advance in anticipation of high load times, such as during the beginning and ends of semesters. For larger partners we may, depending on size and performance requirements, dedicate application servers for specific clients.

Updates/patches

Application server operating systems are updated regularly with security patches. These are done one at a time, so that there is no interruption in servicing clients.



Upgrades to the application itself are also done in a way that does not affect the clients using the service.

Caching

The caching layer provides a substantial performance optimization. A healthy cache means that the application servers need to make fewer trips to the database, speeding up response times. The caching layer is made up of several machines running memcached. Data is spread out across all machines. All the data stored by the cache is ephemeral - therefore losing a caching node does not include data loss.

Component Failure

The cache servers are constantly monitored. When a cache server dies, a new one is provisioned and deployed to take its place. While it's down, the data that would have been stored on it is simply retrieved from the database instead. This may have a temporary performance impact on the service until the new cache node is deployed.

Capacity

Cache servers are completely memory based. Memory usage is monitored continuously by Instructure, and when the cache hit rates falls below an acceptable threshold, new cache servers are provisioned and deployed.

Updates/patches

Cache server operating systems are updated regularly with security patches. These are done one at a time, so that there is no interruption in servicing clients.

Database

Important course and user data is stored in relational databases. The databases are partitioned by institution for performance and data isolation reasons. Each institution has a pair of databases: a Primary and a Secondary in a separate location. The Primary replicates all data to the Secondary in near real-time. A complete backup is also taken every 24 hours and stored in a third geographically separate location

Component Failure

On failure of the Primary database, the Secondary will be promoted to Primary and a new Secondary database provisioned and deployed. Upon failure of the Secondary database, a new Secondary database is provisioned and deployed. In the unlikely event of simultaneous component failure or data corruption, the most recent daily backup will be used to create a new database pair. Please refer to the Disaster Recovery Plan for more details and a discussion of RPO and RTO.

Capacity



Databases are constantly monitored for resource usage and response time. If either database begins to reach peak load, it will be migrated to a server with higher resources. Our experience and testing show that this "scaling up" is adequate for most institutions.

Updates/patches

Since the databases together form a "single point of failure" for a given population of users, updates to each system are performed carefully and with planning. Generally, one database will be updated at a time. First the Secondary database will be updated, then promoted to be the Primary, then the (new) Secondary will be updated.

Distributed File Store

Digital assets like files, documents, and learning artifacts are stored outside the database in a separate and scalable service. Metadata and access control are stored and maintained within the relational database. The architecture of this storage tier is very similar to the Instructure architecture outlined in this document. Additional capacity and scaling is performed independent of the other tiers on an as-needed basis. Instructure has partnered with Amazon S3 to provide industry-proven scaling, reliability, and data integrity.

Rich Media Store

Rich media like videos, audio recordings and webcam captures are stored outside the database in a separate and scalable service. Metadata and access control are stored and maintained with the relational database. The architecture of this media tier is very similar to the Instructure architecture outlined in this document. Additional capacity and scaling is performed independent of the other tiers on an as-needed basis. Instructure has partnered with Kaltura to provide industry leading storage, streaming, and recording of digital media.

v) Vendor shall describe the overall security architecture of the proposed LMS service.

Please refer to Appendix D “Canvas Security.”

w) The Vendor shall describe how the state will get its data back in a form that can be used in the event of contract termination or expiration or if the State desires a different service.

During the term of this agreement and for 3 months after expiration or termination, Customer may export the Customer Content through the API or by using the export feature of the Service.

x) The Vendor shall integrate with Pearson PowerSchool. Additional information provided in Attachment 5. This integration shall include course/class enrollment synchronization and course/class section creation using designated master content. Additionally, PowerSchool integration shall include grade book synchronization. The vendor shall describe their integration in detail including synchronization and update schedules.

The Canvas implementation service includes the configuration and testing of our turn-key integration with PowerSchool (version 7.2 or later) for one-way creation and synchronization of teacher and



student accounts, courses, sections and enrollments. The scheduled synchronization generally occurs nightly at 2:00 AM MST/MDT but can be modified to accommodate the clients needs.

Instructure is committed to and actively developing grade book synchronization as part of our PowerSchool solution. This future solution will allow teachers to selectively choose which assignments to “Post to SIS” and to synchronize the selected assignments and their associated grades to PowerSchool on demand without the need for manual export/import.

y) Vendor shall describe how they will handle teachers and students who teach or are enrolled at multiple LEAs.

Canvas offers several options for supporting teachers and students who teach or are enrolled at multiple LEAs. In the event one or more of the following attributes are true, Canvas may support allowing students and teachers to use their common credentials regardless of which LEA they are accessing:

Teachers and students retain a single staff ID or student ID for use at the multiple LEAs LEAs use a common method of authentication (e.g. LDAP, Active Directory) or single sign-on

(SSO) such as CAS, SAML, Shibboleth and ADFS.

In addition, Canvas fully supports the (likely) less favorable option of allowing students and teachers to use and maintain different credentials for each LEA.

z) The Vendor shall integrate with the NC Learning Object Repository. Additional information provided in Attachment 4. This integration shall include learning object insertion from NCLOR directly from course management interface with objects embedded in the system with links to the NCLOR. Users hall be able to search NCLOR by keyword, standard, title, grade and subject. The Vendor shall describe their integration.

Canvas supports user-authenticated integration with any EQUELLA instance (including NCLOR) as a core integration allowing users to search and link to EQUELLA content via an EQUELLA option in Canvas’ Rich Content Editor. The Canvas EQUELLA integration allows users to search by any field made available in the EQUELLA configuration. Configuration of the Canvas EQUELLA integration requires minimal effort as described in the Canvas help guide.

http://guides.instructure.com/m/4214/l/41898-how-do-i-enable-equella-for-my-account



aa) The Vendor shall integrate with the NC Education Cloud Identity & Access management Service for authentication. Additional information provided in Attachment 3. Vendor shall describe in detail how they need to interact with the NC IAM service, e.g. SAML or LDAP could be used for authentication and/or authorization in addition to providing updates to user attributes. How would teacher/course assistants be handled? The Vendor shall describe how it will provide role-based access controls with appropriate authentication rules as mandated by the State of North Carolina. These rules may be viewed at the following internet address: http://www.scio.nc.gov/mission/itPoliciesStandards.aspx

The Vendor shall have role-based password policy management for application controlled accounts. This shall include a 90-day password change policy.

Canvas’ only password requirement for Canvas-controlled passwords is that the password must be at least six characters. For more robust password policy management, we recommend leveraging Canvas’ support for external authentication (e.g. LDAP, Active Directory) or single sign-on (SSO) such as CAS, SAML, Shibboleth and ADFS.

bb) The Vendor shall deliver to NCDPI a Technical Implementation Plan within the first 30 days following the RFP award. The plan shall include specific, detailed tasks and responsibilities.

Canvas is a SaaS based Learning Management System; we provide a Customer Success Managers (CSMs) to serve as the primary points of contact for NCDPI during the implementation and after.



CSMs work directly and proactively with client institutions to ensure that clients’ questions are answered, to communicate information in an effectively and timely manner, to coordinate access to Instructure’s resources, and to provide overall account management. CSMs communicate with client institutions by phone, email, web conference, and chat.

Canvas will work with the District to meet its timeline and schedule requirements. Please refer to Table for descriptions of Instructure’s implementation services. NCDPI will have a dedicated Customer Success Manager that will continue to be available for weekly calls and updates.

Table 3 outlines the Instructure’s typical implementation plan and timeline for new client institutions. The typical timeframe for an implementation and full migration of legacy LMS content falls in 4- to 16-week range. The exact timeline for a particular implementation depends on whether the institution will be utilizing API functions, SIS imports, identity provider options, and the availability and expertise of resources within the client institution.

Table 3. Implementation Plan

Action Item Responsible Party

Contractual Agreement

Milestone: Signed Contract

Assessment / Inception Phase

Milestone: Assessment / Inception Completed

Provide implementation checklist in prep for call Instructure

Kickoff / planning call Instructure & Client

Introduce implementation team Instructure

Finalize implementation checklist Instructure & Client

Customize project plan to fit institution Instructure

Share overall project plan (provide login) Instructure

Create migration plan for instructors and content Instructure & Client

SIS integration Instructure & Client

Initial Testing - Test Cluster

Milestone: Test Cluster Creation

Create institution test cluster Instructure

Configure and test authentication Instructure & Client

Provide branding information to institution Instructure




Configure and test SIS import Instructure & Client

Test initial course migrations Instructure

Training

Milestone: Trainings Completed

Set up user training system Instructure

Administrator training Instructure & Client

Support Setup training Instructure & Client

Instructor/User training Instructure & Client

Ongoing organizational training Client

Set Up Support

Milestone: Support Structure In Place

Determine support structure Instructure & Client

Configure Zendesk account Instructure

Provide customer account for Zendesk Instructure

Setup escalation paths Instructure & Client

Build Out Production

Milestone: Build Out Phase Completed

Create production instance Instructure

Setup branding on production instance Client

Setup authentication (Active Directory, LDAP, SAML, CAS)

Instructure

Configure integrations (see optional integrations list)

Instructure & Client

Enable required integrations Instructure & Client

Migrate course content Instructure & Client

Configure cross-listed courses Instructure & Client

Configure accounts and sub-accounts Instructure & Client

Setup roles and permissions Client

Add any account level learning outcomes Client




Finalize Courses and Ready for Go Live

Milestone: Validation & Acceptance

System hierarchy completed? Instructure & Client

Users and permissions set? Instructure & Client

Integrations completed? Instructure & Client

Training completed? Instructure & Client

Instructor's courses ready? Instructure & Client

Support ready? Instructure & Client

Optional: Integrations

Milestone: Integrations (if any) Completed

Additional SIS integration? Instructure & Client

Course content providers? Instructure & Client

Media provider? Instructure & Client

Additional authentication? Instructure & Client

3rd party tools? Instructure & Client

Plagiarism checker? Instructure & Client

Quiz/testing tools? Instructure & Client

Conferencing tool? Instructure & Client

Clicker solution? Instructure & Client

cc) The LMS service shall provide a mobile solution with greater than 95% functionality of the web version.

Canvas mobile apps provide a full, interactive user experience. Canvas is available as a native app for iOS and Android. Canvas apps for IOS and Android provide exceptionally rich user experiences on smart phones and tablets as shown in Figure 6 and Figure 7. Canvas also offers a SpeedGrader app for the I-Pad, as shown in Figure 8.



Figure 6. Canvas by Instructure for iOS

Figure 7. Canvas by Instructure for Android



Figure 8 SpeedGrader for iPad

Canvas mobile apps provide:

Instructors and students with the functionality needed to access and engage in the teaching and learning experiences of Canvas courses, anytime and anywhere



A clean, intuitive interface for students to submit assignments, take quizzes, participate in discussions, and other learning activities

Communicate privately through conversations, collaborate and complete assignments through Discussions, and also give feedback and ask questions through submission comments.

Use mobile video to make media comments for a stronger interaction between instructor and student.

Critical interactions are supported, including learner-to-content, learner-to-instructor, and learner-to-learner interactions through tools adapted especially for small devices.

Assignment submissions from most cloud-based mobile apps including Dropbox, SkyDrive, and Google Drive

The Grades tool for users to view their graded assignments, assessments, and other coursework

Zooming capabilities and utilizes standard mobile device navigation and interaction techniques such as finger-swiping for paging, pull-up and pull-down menus, and tapping for item selection.

A tutorial “training camp” when users open the app for the first time. Access to external IMS Learning Tools Interoperability (LTI) compliant tools

dd) The LMS service shall work with all Vendor supported web browsers: Safari 7+, Chrome 35+, Firefox 28+, IE 10+

Canvas supports the last two versions of every browser release. We highly recommend updating to the newest version of whatever browser you are using as well as the most up-to-date Flash plug-in.

As of August 28, 2014, we support the following desktop browsers and Flash versions:

• Internet Explorer 10 and 11

• Chrome 36 and 37

• Safari 6 and 7

• Firefox 30 and 31 (Extended Releases are not supported)

• Flash 12 and 13 (for recording or viewing audio/video and uploading files)

• Respondus Lockdown Browser (supporting the latest system requirements)

ee) The LMS service shall support Google Chrome OS, Chromium and Chromebooks.

Canvas works across all major browsers across platforms, leveraging the best and newest capabilities they provide. Canvas is equally compatible with all supported browsers. Java is not required. Flash is used minimally.



ff) The LMS service shall be touchscreen compliant and platform independent; must be accessible from iPad 2 and later devices in addition to Android 4.0 and later devices. Vendor shall include a list of tested devices.

Canvas testing is completed on all supported desktop browsers, Canvas apps for supported iOS devices (i.e. iPad, iPhone/iPod) and Canvas apps for standard Android phone and tablet devices including Kindle Fire. In addition, we actively monitor and work to remedy issues reported when related to the user experience when using a standard mobile browser.

Canvas provides four native mobile applications free for download on both phones and tablets. We are actively improving our native mobile applications to support as many Canvas features as possible. Please note that mobile applications are only supported in English at this time.

• Canvas by Instructure (iOS 7.0+, Android 4.0+). This app provides access to Canvas for both instructors and students while on the go. Depending on your device, not all Canvas features may be available on the app at this time. View Canvas mobile features by version and device.

• MagicMarker (iPad only, iOS 7.0+) This app is specifically designed for instructors to assist them with standards-based learning. Syncs with the Learning Mastery Gradebook.

• Polls for Canvas (iOS 7.0+, Android 4.0+). This app is the easy to way for instructors to collect student opinion in their classrooms without any extra devices.

• SpeedGrader™ App (iPad only, iOS 5.0+). This app is specifically designed for instructors and allows them to grade student submissions on the go. Syncs with SpeedGrader™ and the Gradebook.

gg) The LMS service shall be HTML5 only; it shall not require Java, Flash, or Silverlight.

Canvas is built in web standards, including HTML5. Canvas supports HTML5, CSS3, and JavaScript. HTML5 code can be entered directly in the HTML view of the Rich Content Editor. Canvas requires minimal use of Flash and does not require Java or Silverlight.

hh) The LMS service shall provide an automated course copy tool.

Virtually any Canvas course and any type of Canvas course content can be copied as well as reused as masters and templates for creating other course content. Canvas’s integrated tools—“Import Content into this Course” and “Export Course Content”—that make it easy to import, export, and copy courses. The Import Content tool imports legacy LMS courses, Common Cartridge courses, and QTI assessments and question banks. The Import Content tool also copies Canvas courses and course content. In

http://guides.instructure.com/m/4214/l/41056-which-browsers-does-canvas-support

http://guides.instructure.com/m/4152/l/196070?data-resolve-url=true&data-manual-id=4152

http://guides.instructure.com/m/4152/l/196070?data-resolve-url=true&data-manual-id=4152

https://s3.amazonaws.com/tr-learncanvas/docs/Mobile_CanvasbyInstructure.pdf



general, the import and copy processes comprise four simple steps:

1. Select the Content Type

2. Choose the Source File

3. Specify options for the content type

4. Click Import The Import Content tool maintains a list of jobs and their statuses as shown in Figure 9.

Figure 9. Import Content Processed Jobs

The Export Course Content tool is even easier. Select “Course” to export the current course or “Quiz” to export one or more of the quizzes in the current course, then click Export. Because it can take a while to export large courses, you can leave the Export Course Content tool and Canvas will notify you by email when the export is complete and ready for download.

ii) The LMS service shall provide automated enrollment and course creation.

Canvas supports batch and near real-time integration with enterprise level, student information systems (SIS), and other external systems for the data interchange of institution data including registration, course creation, users, and enrollment information. The integration framework supports the following data imports via a fully automated, batch-enabled API:

Users (Students, Instructors, etc.)

Accounts (Campuses, Colleges, Departments, etc.)

Terms (Semesters or other types of terms)

Courses

Sections

Enrollments (Student, Teacher, TA, Course Designer, Observer)



Groups

Group enrollments/memberships

Cross-listing of courses and sections

In each institution’s account, the full organizational hierarchy is recreated through the SIS integration. These sub-accounts of the institution reflect the different colleges, departments, programs and courses unique to each school. This concept of reflecting the organization of each institution is applied to sharing content, aligning learning outcomes, reporting, and reusing assessment rubrics.

Through the Canvas open API, institutions can control courses, users, and student enrollments at a very fine level of granularity. For ease of integration, Canvas also provides bulk enrollment endpoints (CSV and IMS Enterprise XML) for various SIS systems. All SIS endpoints are capable of importing enrollment data in both real-time and in batches in addition to natively supporting cross-listed courses.

jj) The LMS service shall provide course archival and retrieval including: archive of all course data including grade book, recovery of only selected modules within a course, and import of content from an archive. Vendor shall describe in detail how course archival will function. Please include options for Vendor provided archival and retrieval and options for LEAs and Charter Schools to archive themselves. Please discuss access, storage and timing.

The Amazon cloud infrastructure supporting Canvas provides auto-archiving of student data. Any data that enters the Canvas platform is automatically saved redundantly across several servers and data centers. Data backups occur in real-time and require no specific intervention or request. In addition to the live replication provided by the Amazon infrastructure and Canvas implementation, Instructure routinely backs up Canvas databases and files for storage off-site and off of Amazon’s infrastructure, providing complete redundancy of all data and eliminating any single point of failure. Elements are always available until the client asks for archived materials to be deleted.

In addition, Canvas includes the Course Copy tool.

kk) The LMS service shall have complete log files and audit trails for policy enforcement that detail who has access and/or modified which data, made or approved requests (and when), and cleanly tracks how a user moved through the system. Log data shall be available in user reports (see below), and access to the raw log data shall also be available.

Canvas provides real-time system monitoring of system availability, database space available, network, and infrastructure. Instructure continually monitors usage, system health, and security of Canvas. Instructure uses a combination of internal and external monitoring systems for maximum coverage, such as Zabbix, pingdom, and pagerduty, as well as some custom systems. This is in addition to "monitoring" that may be thought of simply as user logging and regular internal and external security audits.

Administrators do not have open access to the Canvas database. Instead, the Canvas paradigm favors data access via an open API as opposed to direct database access:



While the Canvas API paradigm requires a trade-off, we decided that the benefits of direct access were trivial compared to the more potent benefits that all our customers gain from our cloud-native architecture. For example:

Canvas's built-in disaster recovery with multiple geographic redundancies means that there is no "one" database. The Canvas API can potentially map SIS updates to several data stores in lots of places.

The API allows greater control and performance guarantees of the system for all users, regardless of simultaneous connections.

Our approach is more robust in that it allows us to update Canvas and even modify the underlying database schema without breaking your custom integrations (SIS or otherwise).

Since the mechanism for updating data is so well defined, we help users avoid accidental modification of the LMS data store, and the fun ramifications those might incur. I'm sure this has never happened to you, but we have to be safe for all our customers.

Many of our clients have SIS systems that are 1) not internet accessible, or 2) not SQL based. Our approach works for all customer needs.

If our out-of-the-box approach is not ideal for your situation, we do offer another path: You can open up a secure and authenticated ODBC connection to your SIS database, and we have an add-on product that can query your database and update Canvas accordingly.

ll) The LMS service shall have detailed user activity reports that include, but are not limited to, time spent per question on assessments, time spent adding/changing content, completed activities.

Canvas Analytics analyses, provides statistics on, and reports grades per one or more students, one or more assignments, one or more categories, and for the entire Gradebook. Using Canvas Analytics, faculty can view all of these things in a very granular way.



Figure 10. Canvas Analytics: Course View

Figure 11. Analytics Course View: Student Section

Course Analytics enable admins and faculty to:

• Predict how students react to course activities.

• See which students are at-risk and need help.

• Evaluate the effectiveness teaching strategies.

• Quickly view of students’ progress.



Canvas analytics displays both class and student progress reports in the Student Summary for the individual student see Figure 12.

Figure 12. Student Summary Information

The summary information includes the student’s name [1], the student’s current total of the grade [2], and the name of the course [3]. A message can be sent to the student by clicking the envelope icon. Use the arrows to step through the course roster or use the drop-down menu to select a particular student [4].

1.1.1 View Activity Figure 13 shows the Activity section of the Analytics Individual Student view.

Figure 13. View Activity

The individual student’s participation is shown by date on the x-axis and the number of activities on the y-axis. To view the details, hover over the bar on the graph. The blue bar indicates the number of page views and the orange bar indicates if the student took action on a page or participated in the course same way.

1.1.2 View Communication Figure 14 shows the Communication section of the Analytics Individual Student view.

Figure 14. View Communication



The speech bubbles represent the conversations between instructor and student. To view the details, hover over the speech bubbles to view the date the conversation took place and how many messages were sent. The orange speech bubbles indicate the date of students sending messages to instructors [1]. The blue speech bubble indicates the date of instructors sending messages to students [2].

1.1.3 View Assignments Figure 15 shows the Assignments section of the Analytics Individual Student view.

Figure 15. View Assignments

The Assignments section identifies which assignments the student has or has not submitted. Each row represents an assignment. The diamond indicates the due date and the bar is when the assignment was submitted. Green means that the assignment was submitted on time. Yellow segment means that the assignment was submitted late. Red means that the assignment was never submitted. Gray diamonds are assignments without due dates, but have submissions.

1.1.4 View Grades Figure 16 shows the Grades section of the Analytics Individual Student view.

Figure 16. View Grades

Each bar represents an assignment. The thin whisker extends from the minimum score for the individual in the course to the maximum score. The wider bar extends from the 25th percentile to the 75th, with the median marked. The individual student’s score is marked with a dot. Assignments submitted on time are represented by a green dot. Assignments submitted late are represented by a yellow dot. Assignments not turned in are represented by a red dot.

http://guides.instructure.com/s/2204/m/4152/l/66793-what-will-analytics-tell-me-about-my-student/show_image?image_id=2012271



mm) The LMS service shall allow for copying of one piece of content from course to course and maintain NC Learning Object Repository links.

Canvas Import Content feature allows users to browse and select one or multiple content items (or the entire course image) from another course. NCLOR links copied from the source content items are copied and fully functional.

nn) The LMS service shall provide data dumps/snapshots on demand for local backup purposes.

Canvas does not currently provide data dumps or snapshots on demand; however, it is an item that we are discussing and we would be happy to discuss this with NCDPI.

oo) The LMS service shall provide a grade book. The grade book shall have user defined perassignment weights. It shall have user-defined scales, including number, letter and plus/minus options. The grade book shall have user defined categories and subcategories. It shall support weighted scales by category scores. It shall support mastery/non-mastery grading (pass/fail).

The Canvas Gradebook is automatically generated and updated based on course assignments, assignment groups, and assessments which are directly linked to the Gradebook and its integrated feedback features. In the Gradebook, you can view the roster by all or selected sections and by concluded enrollments. The Gradebook can be sorted by individual grade book item columns. In the SpeedGrader, assignments can be sorted by student name, submission status, or submission date/time. Gradebook features include:



• The Gradebook contains columns for percentages by weighted Assignment Groups and for Total Grade percentage. Canvas Analytics provides statistical analysis and graphical representation of grades.

• The Gradebook interface provides the Upload Scores and Download Scores features for the import and export of grade data in CSV format.

• The Gradebook supports calculated columns using data from multiple columns with a variety of functions.

• Calculated columns are based on weighted assignment groups for the associated individual grade book items/columns. There is no maximum of calculated columns.

• The View Grading History function in the Gradebook supports versioning/ audit history for grade changes.

• The Mute Assignment feature in the Gradebook allows the instructor to control when the grades and feedback for a particular assignment can be viewed by students.

Figure 17. Faculty View: Gradebook

• Grading Schemes determine the data formats, rounding, and decimal options. In the Gradebook, the Set Default Grade feature and the Curve Grades feature, shown in Figure 18, can be used for each gradebook item column.



Figure 18. Curve Grades Feature in the Gradebook

pp) The LMS service shall have conditional release for mastery including complex Boolean logic that supports both AND and OR operations.

Canvas does not currently support Boolean logic for conditional release. Canvas Modules allows instructors to set condition releases. Canvas Modules allows teachers to set a quiz to become available only after a specified score is received on another designated quiz. Administrators and instructors can sequence Modules by defining criteria and prerequisites. Modules can be locked until a given date or until students satisfy defined prerequisites. For example, an instructor can specify that a module remain locked until students have achieved 75% or higher on a review quiz. Using drag-and-drop, instructors can easily re-sequence the content of Modules.

Figure 19. Course Modules



qq) The LMS service shall provide analytics for administrators, teachers, students and parents to include reports for the following scenarios:

i. Which Algebra I students are failing Module 1?

At the class level, the instructor, principal or other custom roles can identify failing students using the Gradebook or ‘Message students who..’ (feature described in the response to question ii below).

Data identifying Algebra I students failing Module 1 across all Algebra I courses can be exported programmatically using the Canvas API providing the modules and assignments used in the courses use common naming conventions.

ii. How many students have not met the conditional release parameters to release the next module?

Canvas’ ‘Message students who..’ feature provides the quickest actionable route to identify students who have not met conditional release requirements. This feature is available for every assignment, quiz/test or graded discussion via the gradebook and also directly from the quiz interface. Options include messaging or simply identifying students who a) have not submitted, b) haven’t been graded, c) scored less than or d) scored more than.

In addition, the Modules Progress Report makes it very easy for teachers to quickly identify student progress and completion.



iii. When was the last time a parent logged in?

The People page in each course shows the date/time of most recent activity (including login) for all enrollments including observing parents. In addition, the Access Report (accessible by viewing a particular enrollee) provides a detailed log of the user’s activity in the course. In addition to accessing these course-level reports, administrators, principals, or an custom administrative role can view a detailed access log of the parent or user’s activity across all courses in which they are enrolled.

iv. How many teachers have not entered grades in the last 24 hours? Or the last 7 days?

The Canvas API supports the export of data to support just about any reporting use case that may not already be support in Canvas reports or analytics. For this specific use case (i.e. identifying teachers who have not entered grades in the last x hours or days), the ‘Query by grader’ or ‘Query by course’ API calls can be used to gather the appropriate data. In addition, Instructure’s Professional Services team is skilled in custom report development made available via Canvas’ existing reporting architecture.

rr) The LMS service shall allow content/images to be shared between courses, including accessing content from another course, importing content from a course archive and linking to shared content (NOT a copy).

Canvas Import Content feature supports import from courses, course archives, master courses and repository courses. The Import Content feature allows users to copy an entire course image or to browse and select one or multiple content items (or the entire course image) from another course.



In addition to Canvas's existing capabilities to support course management, replication, and content sharing, Instructure is actively developing a new Learning Object Repository (LOR) to enable educators to share high-quality learning materials with their peers worldwide. With the ability to discover content easily—both within a institution or with educators around the world—educators will easily be able to create engaging courses without spending countless hours creating materials from scratch. The LOR will:

Help educators quickly import materials to create high-quality, engaging courses Enable educators to rate the available materials, allowing the highest quality tools to “rise to

the top” based on the ratings from the community Foster a community of instructional innovation and collaboration by encouraging sharing and

remixing of faculty-authored materials Support institutional management of curricula for maximum efficiency and reusability Integrate tightly with the Canvas LMS, enabling teachers to seamlessly add courses, lesson

plans and other materials directly to the LOR as they create them, so sharing materials is quick and easy

The Canvas LOR is scheduled release in Fall 2014 and will focus on the sharing, finding, and remixing of course content by teachers and designers within a institution.



ss) The LMS service shall allow the sharing of student submitted content.

Canvas supports the collaboration or sharing of student work. Canvas leverages technologies like Google Docs and EtherPad allow multiple users to work together on the same document at the same time. Collaborative documents are saved in real-time, meaning a change made by any of its users will be immediately visible to everyone.

Canvas Collaborations. Groups can share content areas using web-based tools such as wikis and blogs that users are already familiar with. Users can use resources like Google Docs or EtherPad to work collaboratively on tasks like group papers or note-taking. Collaborations provide a convenient, common work space to keep track of those collaborative activities, all without the need to exchange personal email addresses.

Figure 20. Canvas Collaborations interface.

tt) The LMS service shall allow peer review of student submitted works.

Canvas allows peer review annotations on submissions of online assignments. Instructors can assign students to peer review another student's work.



Figure 21. Peer Review Notification

uu) The LMS service shall support co-teachers.

Canvas supports co-teaching capabilities. With Canvas co-teachers have complete access to the course materials, assignments, quizzes, discussions, chats, announcements, and more. All of the material is in a single location and accessible to the teachers.

vv) The LMS service shall have Learning Tools Interoperability (LTI) support for integration of third party content development tools, including, but not limited to, SoftChalk Cloud and Kaltura. The vendor shall provide a list of tested LTI services.

Canvas provides a standards-based platform with an open API and an extensive set of supported third-party integrations. In 2013, Instructure became the only LMS to offer “one-click” installation of IMS Learning Tools Interoperability (LTI) compliant tools and services, when it announced the integrated Canvas App Center. The Canvas Edu App Center (http://www.eduappcenter.com) is a rapidly-growing app library with over 140 apps providing interactive resources, content repositories, assessment tools, social media, and other digital learning and teaching resources including SoftChalk Cloud and Kaltura. Table 2 shows a partial list of the third-party integrations that Canvas supports. Note: Tools and services denoted with an asterisk (*) are provided and/or supported by Canvas at no additional cost. Canvas support for integrations with the non-asterisked third-party tools and services is included at no additional cost but institutions would need to already have or need to obtain licensing for those products from their respective vendors.

Table 4 Partial List of Third-Party Integrations Support

Content/Tool/Service Description

ARES Library e-reserve and copyright management system

Box Content management and collaboration tools




ConnectEdu CoursEval Course evaluation, analysis, and tracking

Dropout Detective Student retention data aggregation and analysis

EQUELLA Content management and digital repository

Facebook*, Twitter*, and LinkedIn*

Social networking site

Google Drive* and EtherPad*

Creating, editing, storing, printing, and sharing documents, spreadsheets, and presentations

Canvas App Center IMS LTI-Compliant Tools and Services

Over 130 supported LTI-compliant tools and services including Mahara (ePortfolio), Cengage Learning (content development), Campus Pack (ePortfolios, blogs, wikis), SoftChalk Cloud (open-licensed learning resources), WikiSpaces (education wikis), WordPress (blogs), and Khan Academy (courses). Please refer to the Canvas App https://www.eduappcenter.com/ for a complete listing

Kaltura*, ShareStream, Ensemble Video

Media management, providing audio/video recording, and streaming

McGraw-Hill Campus Digital learning resources

McGraw-Hill Connect Online learning assignment and assessment solution

Pearson MyLabs Interactive courses, content, and assessments

Respondus Assessment development, management, and publishing and LockDown browser

SCORM Cloud Course and content standards conversion

Scribd* and Crocodoc* Online electronic document publication and sharing service providing inline document previews

SoftChalk and SoftChalk Cloud

Content development and management

SonicFoundry MediaSite Enterprise webcasting, lecture capture, and hybrid event platform

Student Information Systems (SIS) and Human Resources Information Systems (HRIS)

Ellucian (formerly SunGard Banner or Datatel Colleague), PeopleSoft, Jenzabar, CampusVue, Poise, PowerSchool, CampusKey, and other SIS/HRIS that can export data can be translated into the Canvas CSV format or sent directly to the Canvas SIS API.

Study.net Digital learning content

https://www.eduappcenter.com/




Tegrity, Panopto, Echo360

Lecture capture

Third-party content and legacy LMS course/content import

Cengage ePack, Canvas Common Cartridge, McGraw Hill Common Cartridge, Pearson ePack, WW Norton packages, SCORM 1.2 and higher packages (content only) , Blackboard 6-9x, WebCT CE 6+, WebCT Vista 1-4, ANGEL, Moodle, and Desire2Learn

TurningPoint, i>clicker Classroom response system (clicker)

Turnitin Plagiarism checking service

BigBlueButton*, Wimba, Blackboard Collaborate, WizIQ

Web conferencing and collaboration tools

Additional third-party systems, applications, and services*

Flickr, Delicious, Diigo, Skype, Amazon, Google Calendar, RSS/Atom Feeds, iCal, YouTube, and mobile apps

One way that Canvas ensures that we are in synch with third-party integrations is by establishing partnerships. Our Partnership Program establishes strategic relationships with third-party vendors, education content publishers, and service providers. The website for the Partnership Program is http://www.instructure.com/partners.

• Premier Partners include Pearson, Cengage Learning, McGraw-Hill, and Wiley.

• Certified Partners include: EQUELLA, Respondus, Panopto, Turning Technologies, WizIQ, i>clicker, Study.Net, SoftChalk, ShareStream, W.W. Norton & Co., CourseSmart, Macmillan, eXplorance, AspirEDU, Adobe, Ensemble Video, EvaluationKIT, and more.

• Community Partners include NOOK Study, Blindside, Scribd, Turnitin, and Crocodoc.

http://www.instructure.com/partners



ww) The LMS service shall allow assessment feedback with multimedia support for teacher video responses to an individual student.

The SpeedGrader enables instructors to attach text/audio/video feedback as well as files to the coursework. Users can attach video or audio commentary without even leaving the SpeedGrader screen. A screen pops up and allows the user to record quickly and easily and then the video preview is automatically inserted in the comments. Instructors can provide feedback to students, including marked-up copies of student coursework submission, without having to navigate away from the document viewer. The SpeedGrader also includes a speech recognition feature to convert recorded audio comments to text. Instructors can also annotate, highlight, and comment on submissions as shown in Figure 22. SpeedGrader is available to grade any assignment, test, or discussion.



Figure 22 Annotating, highlighting, and commenting on submissions.

A unique feature of Speedgrader is that students can respond to feedback with text/audio/video. By allowing for response, instructors can modify feedback to include follow-up questions to students or suggestions for improvement. Students can them respond to clarify instructor concerns or ask their own follow up questions. An assignment is no longer merely a document submitted and then forgotten, the ability for student response helps documents and learning objects continue to develop and change. Ideally, the student will respond to the feedback and continue to develop a deeper understanding of the assignment, possibly revising to improve. Allowing dialogue helps change feedback from general comments to an opportunity for continued learning and improvement.

xx) Vendor shall describe in detail their assessment functionality including accommodations and security.

Formative and Summative Assessments

Canvas provides tools to support your needs for both formative and summative assessments, as listed and described in Table 5 and Table 6.

Table 5 Canvas Tools for Formative Assessment

Tool Application



Tool Application

Assignments Supports assessment using SpeedGrader's rubric, annotation tools, and discussion provide corrective feedback. Supports multiple assignment submissions and revisions. Supports linking one assignment to another. Supports URL submission for blog posts and other coursework. Provides peer review.

Surveys Collects direct feedback from students (self-reports). Evaluate course design, content, and delivery.

Discussions Supports reflective topics requiring students to metacogitate, understand and accept critical feedback from peers, and form opinions through diverse perspectives.

Quizzes Supports multiple attempts, automated feedback, and module release based on prerequisites and completion criteria. Assessment using SpeedGrader's rubric, annotation tools, and discussion provide corrective feedback.

ePortfolio Provides for comments on any page or artifact that can direct students to think critically on their work and adjust future learning.

Grades Provides “Message students who...” (messaging based on gradebook criterion) and feedback directly on scores.

Analytics Provides student analytics dashboard reflecting past behavior (e.g. activity in the site, interactions, lateness) and suggesting relationships between those measures and current grades.

Table 6 Canvas Tools for Summative Assessment

Tool Application

Assignments Supports rubrics and outcome alignment. Supports Turnitin integration. Supports URL submission for ePortfolio, web sites, wikis, and other coursework.

Quizzes Provides automated scoring, objective question types, multimedia essays, outcome alignment of question banks. Preserves academic integrity with randomization, IP filters, and passcode for proctoring. Supports Respondus LockDown Browser integration.

ePortfolio Provides showcasing of students’ reflections, coursework, and mastery over time. Supports rubric- and outcome-based assessment.

Attendance Provides objective assessment of in-seat time.

Grades Provides calculations of final score based on weighted categories or raw scores.



Tool Application

Discussions Enables students to demonstrate their ability to critically think through a topic, communicate, and engage with others. Supports rubric- and outcome-based assessment using SpeedGrader.

Canvas Quizzes is the most commonly used assessment tool in Canvas. Canvas Quizzes include the following features and functions:

• Support for objective and subjective assessment types

• Support for formative and summative assessments

• Associated grading rubrics

• Support for IMS Question & Test Interoperability (QTI) integrations

• Assignable time limits

• Access codes to authorize access to the survey/quiz for proctoring

• Lock until and lock after dates

• Adaptive release for pre-test and post-test

• Answer shuffling

• Allowing multiple attempts

• Definable comments for each answer selection

• Display the correct answer

• Add extra credit

• Auto-grading

• Import assessments from Respondus and other third party tools and publishers

• Addition of rich media in the assessment via the Rich Content Editor

• Comments box where students can participate in self-assessment. The Quizzes tool uses the Rich Content Editor, a WYSIWYG editor that enables users to create text and rich content for test questions. The Rich Content Editor provides the embedding of and linking to multimedia, video, audio, URLs, files, and other digital resources in course content, coursework, and communications. The Editor provides an HTML view, an integrated equation editor, the ability to integrate with external content repositories and resources, and the ability to record and embed audio/video in content. The Quizzes tool interface is shown in Figure 23.



Figure 23 Quizzes tool interface.

The Quizzes tool provides the following question types: Multiple choice, True/False, Fill in the blank, Fill in multiple blanks, Multiple answers, Multiple dropdowns, Matching, Numerical answer, Formula question, Essay question, File upload question, and Text (no question).

Figure 24 shows the Quizzes interface for creating a multiple answer question and the student’s view of the question when taking the quiz. Feedback is entered in the colored “balloons:” green for correct answers, red for incorrect answers, and blue for general feedback.

Figure 24 Quizzes tool: interactive scoring and feedback.



Like other types of Canvas course content, quizzes can be used as a template to quickly create additional quizzes. Practice assignments and quizzes that have proven effective for students, for example, can be copied and used to create additional practice assignments and quizzes by changing the content or links to resources in the Files repository or external content repositories.

Accommodations

The Quizzes tool enables instructors to set the availability date/times and number of attempts for assessments for all students. The Moderate Quiz function then enables instructors to adjust the time and number of attempts for individual students. Quizzes that allow multiple attempts can also specify whether to keep the highest or keep the latest score.

Canvas Quizzes support the ability to grant special access for a specific learner and groups of learners including extended due dates for assignments, and extended availability, time limits, and/or number of attempts on quizzes. The Quizzes tool provides moderation features including accommodating individual students who require more time or multiple attempts for assessments as shown in Figure 25. The Moderate Quiz interface displays:

1. Student name

2. Number of times the student has already attempted to take this quiz

3. Time it took for the student to complete the quiz; the running time will display for students who are currently taking the quiz (counting down for timed quizzes and counting up for non-timed quizzes)

4. Number of remaining attempts, if any

5. Student's quiz score

To refresh the page and make sure all statistics are current, click the refresh icon [6]. Clicking on the pencil icon brings up an edit page that enables the instructor to give one or more selected students extra attempts on an assessment and extra time on attempts.

Figure 25 Moderate Quiz interface.



Security

The Quizzes tool provides exam security by optionally requiring an access code and/or restricting access via a specified IP address filter. Canvas also supports integration with the Respondus LockDown Browser to prevent students from copying and pasting from other URLs, accessing other applications, or traveling to other websites during an assessment.

Canvas enables instructors to selectively release course content and activities based on criteria that controls when users will be able to view and access them, as shown in Figure 26. Within a course, activities such as quizzes and assignments can be selectively released based on specified class section and “Available From” and/or “Until” dates..

Figure 26 Selective release of course coursework/content.

Question Banks

Creating ad-hoc, automatically graded quizzes in Canvas is extremely quick especially with Question Banks. When a quiz is linked to a question bank, teachers can choose from question banks that they have built in other courses. Teachers will also see account- and sub-account-level Question Banks, making it easy for teachers in the same department or program to share resources. When an assessment is linked to a Question Bank in a Question Group, Canvas will use questions from that Question Bank and reference as many questions as indicated when the Question Group was set up, as shown Figure 27.

Figure 27. Create a Question Group



Canvas will reference the chosen bank of questions [1] as each student takes the quiz. Each student will get a random number of questions pulled from the bank. These questions will not be in sequential order and will be random each time the quiz is taken or previewed.

Instructors can choose from Question Banks that they have built in other courses or create new Question Banks. Teachers will also see account- and sub-account-level Question Banks, making it easy for instructors to share institution-, department-, program-, and course-level assessment resources. It would be simple to create Question Banks based on the Standard Course of Study. By having Question Banks that link to the Standard Course of Study, you could ensure that all schools are asking questions that assess the standards while making it simple to collect data on those standards.

Quiz Statistics

The Quiz Statistics feature provides data about Canvas quizzes so that faculty and administrators can view student performance and evaluate the effectiveness and validity of individual questions and the quiz as a whole. In addition, test results can be downloaded in CSV format for subsequent import into an analysis tool. Quiz Statistics show:

• Class distribution of each question

• Consistently unanswered questions

• High ratio of wrong answers

• Mean and standard deviation

• Time to take the exam

• Graphical representations of all student responses Statistics for the selected quiz are accessed by clicking the Quiz Statistics button in the right-hand sidebar of the Quizzes interface, as shown in Figure 28. Each row represents an individual quiz question. The text of the question is given in the first column and the text of each answer and the graphical representation of student responses are given in individual columns to the right. The correct answer is indicated by the green bar.

When the mouse point hovers over an answer bar, the percentage and number of attempts for that answer are displayed.



Figure 28 Canvas Quizzes: Quiz Statistics Redundancy and Failover

By default, the Quiz Statistics feature shows statistics for the students’ latest attempt of taking the quiz. Clicking the Count All Attempts button in the right-hand sidebar will display the collective statistics for all attempts for all students. The average time is updated to reflect the average time of all attempts to take the quiz and each of the question rows are updated accordingly. Note that the Count All Attempts button is replaced by the Count Only Each Latest Attempt button so that you can toggle back to the previous view.

Canvas Quizzes provide item analysis of each quiz, including response chosen frequency, number of students who choose answers for each question.

yy) The LMS service shall have electronic messaging with multimedia support.

Canvas Conversations and Inbox provide an intuitive course and system messaging service, as shown in Figure 29. Canvas allows you to attach previously recorded multimedia files or record new multimedia files in the message tool. As with all messaging in Canvas, Conversation messages are routed to the Activity Streams of participants’ dashboards as well as to the communication channels as specified in individual users’ notification preferences—as messages to their external email, Facebook, Twitter, and/or LinkedIn accounts or as SMS texts to their cell phones. By routing messages to students’, teachers’, and parents’ preferred delivery method, you can ensure that messages are actually being received and read.



Figure 29 Canvas Conversations interface.

zz) The LMS service shall have support for webinar and instant messaging tools (vendor provided or third party).

Canvas provides a synchronous chat tool that allows course members to type in real-time. In addition, Canvas integrates with several third-party synchronous communication tools such as Cranium Cafe, Hoot.me, Scribbler and VoiceThread.

aaa) The LMS service shall have discussion forums with multimedia attachment support on a per class or course basis.

Canvas Discussions provide asynchronous (and near-synchronous) threaded public discussions, subject posting, and replies. Canvas Discussions utilize the Rich Content Editor, which makes it easy to incorporate audio, video, and web links. Discussions support multimedia attachments including audio and video posts as shown in Figure 30.



Figure 30 Canvas Discussions

Canvas threaded discussions are designed for easy navigation, as shown in Figure 31. Color-coding identifies replies that have been read and replies that are unread. A gear icon is provided that presents options to the user to either “Go to Parent” to see the original post, or to edit or delete the current post, or reply. Clicking on the responder’s name will collapse the response to make the discussion easier to view and manage. Canvas also makes it easy to see when a student replies to another student’s post, and presents clearly how many unread, and how many total replies are in the thread.



Figure 31 Canvas Discussions interface.



Creating a discussion is quick and easy, as shown in Figure 32.To turn a focused discussion into a threaded discussion, the instructor simply checks the “This is a Threaded Discussion” checkbox. The instructor also identifies the discussion as a graded assignment through a simple checkbox function.

Figure 32 Discussion Creation Tool

Instructors can determine if students can create new posts, edit or delete posts, or attach files to the post, as shown in Figure 33.



Figure 33 Discussion Settings

bbb) The LMS service shall have role impersonation for administrators and teachers.

In addition to the “Student View” feature, Canvas also provides a “Become other users” permission and a corresponding Masquerade function that enables administrators and IT support managers and staff to proxy as other users so that they can provide training and troubleshooting assistance. To remind authorized users about the proper use of the Masquerade function, Canvas displays the confirmation dialog shown in Figure 34.



Figure 34 Masquerading as a user.

ccc) The LMS service shall have customizable user notifications, including:

i. User selectable notification method: email, SMS or IM.

While Canvas itself encourages and facilitates communication throughout the system, Canvas puts the power of communication within the hands of the individual user. This encourages users to engage with courses using the tools they are most comfortable with, and best fit their lifestyles. Notifications let users individualize the way Canvas informs them of news and activity within their courses using email, text (SMS), or popular third-party social media tools like Twitter or Facebook. Canvas includes configurable Notifications, which help users receive notifications through various channels, including

The Canvas dashboard communication stream

Conversations Inbox, Discussions, Assignment feedback, and Grades

External email

Mobile phone text messaging

Social network tools like Twitter

Users can also determine how they get notifications depending on the category (graded assignment, announcement, etc). Users can also set the frequently of notifications (ASAP, daily, weekly) as shown in Figure 35.



Figure 35 Students Can Opt Into Receiving Grades Notifications in their Account Settings

ii. Daily summary emails with selected statistics.

As mentioned above in ccc i., Canvas offers a notification tool that allows users to determine how and when to receive notifications (see Figure 35). Canvas provides the following notifications: Due Date, Grading Policies, Course Content, Files, Announcement, Grading, Invitation, Submission Comment, Discussion, Discussion Post, Added to Conversation, Conversation Message, Scheduling, Student Appointment Signups, Appointment Signups, Appointment Cancelations, Appointment Availability, Calendar, Groups, and Administrative Notifications.

Canvas provides a robust open API that can be a method for developing custom scheduled daily summary emails for other types of data and reporting including general usage statistics. We would be happy to discuss this requirement with you in more detail in order to find a solution that will fit your needs.



iii. Personalization with form fields – e.g. Dear %USER%

Personalization with form fields is not supported in Canvas. However, as a result of Canvas’ open architecture and robust support for 3rd party applications, personalized user notifications could be accomplished through customization or use of a 3rd party solution.

ddd) The LMS service shall include online journals in a blog or wiki format with forum support.

Students can use Canvas Pages to create rich content wiki pages within Canvas and can include links to personal web pages, blogs, and registered services such as Facebook and LinkedIn. Students can also use public ePortfolios to create personal web pages to display and comment on their coursework. Canvas also supports integrations with popular blogging tools including WordPress, Status.net, and Campus Pack.

The Canvas ePortfolio tool lets students and instructors create online portfolios. The ePortfolio tool would provide an excellent format for online journals. As a showcase of a student’s learning experiences that aggregate both new and past coursework, ePortfolios can be publicly shared and tied into course, program, and/or institutional assessments based on Learning Outcomes. ePortfolios can be organized into Sections and Pages. Page can contain text, multimedia, and/or links to files and coursework submissions. ePortfolio Pages also allow for public and private commenting, as well as forum commenting. In addition, Canvas supports integrations with Campus Pack, Mahara, Pathbrite, PebblePad, and Taskstream. These third-party ePortfolio tools are LTI-compliant tools available in the Canvas App Center. The ePortfolio interface is shown in Figure 36.



Figure 36 ePortfolio tool.

Figure 37 and Figure 38 show examples of University of Washington’s students’ ePortfolios. These ePortfolios are publicly available https://canvas.uw.edu/eportfolios/12907/Home/IntroductionLets_go_diving and https://canvas.uw.edu/eportfolios/12029 respectively.

https://canvas.uw.edu/eportfolios/12907/Home/IntroductionLets_go_diving

https://canvas.uw.edu/eportfolios/12029



Figure 37 Canvas ePortfolio Example #1

Figure 38 Canvas ePortfolio Example #2

eee) The LMS service shall include ability for teachers to create content pages.

The Canvas content creation tools—Pages, Assignments, Quizzes, Announcements, Discussions—all use the Rich Content Editor, a WYSIWYG editor that enables users to create formatted text and rich content for course content and coursework. As shown in Figure 39the Rich Content Editor provides the embedding of and linking to multimedia, video, audio, URLs, files, and other digital resources in course content, coursework, and communications. Files, links, and images can be dragged and dropped from the Content Panel into the Rich Content Editor for the creation of course content and



coursework. The Editor also supports integration with external content repositories and resources such as EQUELLA, YouTube, Flickr, and IMS LTI-compliant tools and services.

The HTML view of the Editor enables advanced users to directly enter HTML code for scientific, music, and other specialized content.

The Editor also includes an integrated Equation editor that enables users to build mathematical equations and chemical formulas using graphical tools or by typing/pasting the equation in LaTeX format directly into the Editor. Equations and formulas are displayed as fully typeset images. The alternative text of the image is set to the LaTeX text of the equation for assistive technologies like screen readers.

Figure 39. Rich Content Editor Interface

fff) The LMS service shall include storage for project based learning (e.g. ePortfolio) including:

i. Students storing works for specific courses than can be exported later.

The ePortfolio provides a showcase of a student’s learning experiences that aggregate both new and past coursework. Pages can contain text, multimedia, and/or links to files and coursework submissions. The ePortfolio makes it simple to bring in coursework from prior courses. Students can even export coursework as a zipfile.



ii. Students sharing content with others, including college admissions.

Students can share their ePortfolio publicly by sharing the link. EPortfolios also allow for public or private commenting. Students can also export ePortfolios as a zipfile and save it that way.

ggg) The LMS service shall allow numeric or alphanumeric grades for assessments.

Canvas supports both numeric and alphanumeric grades. The Gradebook helps instructors easily input and distribute grades for students as shown in Figure 40. Grades for each assignment or assessment can be calculated as points, percentages, complete or incomplete, pass or fail, GPA scale, and letter grades, and assignments can be organized into groups for weighting as well.

Figure 40 Teacher View of Gradebook

hhh) The LMS service shall allow per item numerical weighting for scoring assessments.

Canvas allows instructors to use numerical weighting for scoring assessments. Instructors can determine the point value of each individual item to ensure that each question is weighted appropriately (e.g. 1 essay question worth 5pts, 5 multiple choice worth 1pt each means essay = 50% of score, multiple choice = 10% of score each). Instructors can also use weighting in regards to final grades, as shown in Figure 41.



Figure 41 Weighting the Final Grade

iii) The LMS service shall have multiple language support for assessment creation (e.g. Spanish or English).

Canvas allows teachers or administrators to designate the language for a Canvas course or account, resulting in the translation of all Canvas components.

Supported languages are listed below, however users can request new languages through Transifex, a crowd-sourced project. Crowd-sourced languages are translated and reviewed on a volunteer-basis.

Languages supported by Canvas:

1. English (also UK & Australian localizations) 2. Arabic 3. Chinese (Simplified) 4. Chinese (Traditional - is in progress) 5. Dutch 6. French 7. German 8. Japanese 9. Norwegian Bokmal 10. Polish 11. Portuguese: Spain



12. Portuguese: Brazil 13. Spanish 14. Russian

Crowd-sourced languages:

1. Korean

2. Farsi (Persian: Iran)

3. Turkish

jjj) The LMS service shall provide for teacher progress monitoring.

In regards to teacher progress in a professional development setting, the Professional Development (PD) trainer could use all of the same tools teachers use to monitor their students' progress. In addition, principals or others with a vested interest could check progress of their teachers PD program using the Observer account, "parent portal" functionality and/or custom Canvas roles restricted to view teachers and courses by building, grade or subject.

In regards to alerts as a way of checking for instructor inactivity, Canvas does offer the Alerts tool. The Alerts Tool is specifically an Admin function of Canvas, allowing administrators to set up automatic notification to users based on teacher inactivity, as shown in Figure 42.

Figure 42 Alerts Interface



kkk) The LMS service shall provide grading reports.

In regards to parents having access to grades, Canvas provides a Parent Co-enrollment feature, which enables parents to have an observer role for the courses in which their children are enrolled. The Parent Co-enrollment feature enables parents to log into Canvas and see all of the course material and activities in their children’s courses. Parents can see the text, audio, and/or video feedback that teachers attach to their children’s assignments and quizzes. They can also see discussions, conversations, and other communications that their children have participated in; grading rubrics and the associated learning outcomes aligned to those rubrics so that they know what skills that the course material or activity was designed to teach; and their child’s scores for those learning outcomes to track their child’s progress for specific skills and competencies.

In regards to students receiving notification and reports, students can determine how and when they receive notifications when an assignment is graded (ASAP, daily report, or weekly report).

Canvas also provides a standard student grade report, standard teacher gradebook and administrator Grades report (admin > Settings > Reports > Grade Export).

lll) The LMS service shall allow students to view grades and assessment performance and see feedback.

Canvas allows students to view grades, as well as feedback. Students are notified when they receive a new grade or feedback. Feedback is an essential component of learning and Canvas works hard to ensure that feedback is easy to give and to receive. Instructors can provide feedback to students, including marked-up copies of student coursework submission, without having to navigate away from the document viewer, as shown in Figure 43. The SpeedGrader enables instructors to attach text/audio/video feedback as well as files to the coursework. Students can respond to feedback with text/audio/video. This ability to respond initiates a dialogue between instructors and students creating opportunities for deeper understanding.



Figure 43 Annotating, highlighting, and commenting on submissions.

Students can easily view their grades on the Gradebook, which provides comprehensive information about grades and links to feedback, as shown in Figure 44. Grades are sorted chronologically by assignment due date, followed by assignments with no due dates.



Figure 44 Student Gradebook View

Students can view the name of the assignment [1], the assignment due date [2], the score they earned [3], the total point value of the assignment [4], and icons for any assignment details [5].

Students may also see an icon in the score column [6] indicating the type of assignment they submitted. Once the instructor has graded the assignment, a score will replace the icon. Students can click any score field (including ungraded assignments) and approximate their grade using what-if scores.



Assignment groups will always display as a percentage. For percentages, students can hover over the percentage to see a breakdown in the points they have earned vs. the total points possible.

mmm) The LMS service shall provide per-standard reports for teachers and students.

Canvas Learning Outcomes enables the administration and faculty to track students’ progress as measured by pedagogical goals or desired outcomes.

Outcomes are used to:

• Focus students' attention on the most important skills and activities in a course

• Align Quizzes and Assignments to different kinds of mastery

• Run reports at the account-level about student artifacts of learning mastery

• Align accreditation or other standards to programs of study, courses, or student assessments Canvas Learning Outcomes would be an excellent tool to ensure that the Standard Course of Study in integrated into curriculum on every level from assignments to assessments to portfolios, as discussed in Section 1 Proposal Summary. The Standard Course of Study can be imported into Canvas courses as Outcomes. Outcomes can be nested by dragging and dropping outcomes to reflect organizational structure at the account, sub-account, and course levels.

Learning Outcomes can be tied into coursework allowing administrators to run reports based on individual outcomes: learning outcomes rollup report at the admin level (admin > Outcomes > browse to outcome > click Outcome title) and Outcome Results & Student Competency reports (admin > Settings > Reports).

Another tool that would help with assessing standards is the Mastery Gradebook, which offers teacher and student reports. The Learning Mastery Gradebook helps faculty and administrators assess the outcomes that are being used in Canvas courses. As a major upgrade to the course Gradebook, the Learning Mastery Gradebook provides an overview of student learning based on standards rather than grades. Instructors can also use the gradebook for feedback about curriculum and teaching methods.

The Learning Mastery Gradebook interface is shown in Figure 45. All scores are color-coded to show outcomes and the level attained by each student: mastery (green), near mastery (yellow), and remedial (red). Score levels are calculated based on half of the outcome mastery threshold. You can toggle the boxes in the sidebar to filter scores for a specific level.



Figure 45 Learning Mastery Gradebook Interface

The Learning Mastery Gradebook also allows administrators to view learning outcome mastery broken down by percentage, as shown in Figure 46. The mastery level is broken down into three levels: exceeds expectations, meets expectations, and does not meet expectations.

Figure 46 Outcome Breakdown Percentages



The Learning Mastery Gradebook also allows users to filter the Gradebook by mastery level: mastery, near mastery, or remedial (as shown in Figure 47).

Figure 47 Filtering the Learning Mastery Gradebook

Outcome statistics for the entire course or a course section can be viewed according to course average, course median, or course mode. Instructors and administrators can select the preferred statistic from the drop-down menu next to the score indicator for each outcome, as shown in Figure 48. These course statistics also display color-coded level results based on the outcome results.

Figure 48 Viewing Outcome Statistics by Course Average, Median, or Mode

The Learning Mastery Individual View allows instructors to assess one student and one outcome at a time, as shown in Figure 49. Complete with all features in the Learning Mastery Gradebook, this gradebook view is fully accessible to screen readers.



Figure 49 Mastery Gradebook: Individual View

Individual View contains all the global settings found in the Learning Mastery Gradebook. Instructors can sort by section and hide student names.

In the Learning Mastery Gradebook, instructors can access Individual View by clicking the Switch to Individual View link. Unlike the Learning Mastery Gradebook, Individual View does not take up the entire Canvas window and shows the Course Navigation menu. Like all Gradebook tabs, Individual View is persistent and will always display when it is the last view last accessed by an instructor. To leave Individual View, click the Switch to Grid View link.

In regards to reports on teachers meeting training standards, administrators can view teacher proficiency on PD learning outcomes. Canvas learning outcomes functionality can be used for PD just as it would be for classroom classes. Administrators can also see a roll-up of how each teacher’s group of students performs on standards (to try to help gauge a teacher's effectiveness at teaching a range of standards). Learning outcomes performance data can exported via admin > Settings > Reports or via the API. The data can be grouped by instructor or class as a method of roll-up.

The open API also simplifies pulling learning outcomes data as well as a many other types of data.

nnn) The LMS service shall have a plagiarism detection tool.

Canvas does not have a native plagiarism detection tool; however, Canvas integrates with TurnItIn.

ooo) The LMS service shall have standards aligned assessments with mastery by standards reports.

Assessments created to test student knowledge or to require students to demonstrate a specific skill resulting from a learning activity can be aligned to Outcomes using Rubrics, which can also be used for grading. Grading student work automatically collects and compiles data on student progress for



the Outcomes. The data is available for reporting to support teaching improvement, identify at-risk students, and support the accreditation process. This unified, streamlined approach dramatically reduces the amount of work required to implement Outcomes through the intelligent reuse of assessment workflows in the grading process.

Aligning Outcomes to a bank of questions can provide a more accurate measurement than a single question due to the possible variety of questions and what is being measured. When applicable, it is possible to align multiple Outcomes to a question bank by aligning individual outcomes.

In order to help instructors have an accurate view of study progress on standards, Canvas offers a Learning Mastery Gradebook (for further information see mmm) that gives a view of not only grades but also what specific standards students are struggling with.

ppp) The LMS service grade book shall have drag and drop assignment setup.

Columns are automatically created in the gradebook when an assignment is setup. The teacher can move the Total column to the front of the Gradebook to quickly see an overview of student progress in your course.

qqq) The LMS service shall support per-user role styles.

The Canvas LMS Administrator account includes a Settings tool that helps Administrators manage and customize accounts, courses, user-level settings, features, and functions, including:

Courses Users Statistics

Permissions Outcomes Rubrics

Grading Schemes Question Banks Sub-Accounts

Faculty Journal Terms Authentication

SIS Import Settings

The Settings tool enables administrators to specify the account name, the account domain, the course file quota, the user file quota, default language, default time zone, self-enrollment course settings, quiz IP address filters, custom help links, enabled integrations, enabled web services, course creation permissions, and more.

Access to Canvas information, features, and functionality is controlled by user authentication, user accounts, and user role permissions. The default roles are student, TA, teacher, design, and observer (parent). Canvas provides a fine level of granularity of user-role based access control with over 70 account- and course-level permissions including “Manage (create / edit / delete) course sections,” “Change course state,” “Manage (add / edit / delete) course files,” and other permissions that control access to and the ability to change course-level content and settings

Account Administrators are “super-users” with all permissions granted at the account and course levels. Administrators can be restricted to sub-accounts with full administrative permissions limited to



the sub-account and the constituent courses. The “Manage permissions” permission allows that user role to enable and disable (and optionally lock the setting) the permissions of other user roles as shown in Figure 50.

Figure 50 User role permissions interface of Canvas Administrator’s dashboard.

Administrators can determine what the permissions for each role look like, thus creating a role-style. Then whenever a new user is assigned a role, the user is automatically given those same rights and permissions. As noted above, administrators can also create custom permissions for individual users. Also, users can have different roles depending on the situation. A teacher may take on a student role when working on professional development requirements. If a TA is enrolled as a student in another course, the student will only have student permissions in the course they are taking.

rrr) The LMS service shall meet current accessibility standards, including Section 508, W3C WCAG 2.0 and N.C.G.S. § 168A-7.

Canvas adheres to accessibility guidelines of Section 508 of the Rehabilitation Act as documented in our Voluntary Product Accessibility Template (VPAT), which is publicly available at http://www.instructure.com/canvas-vpat.

By using W3C's Web Accessibility Initiative (WAI) Web Content Accessibility Guidelines (WCAG) 2.0 AA, Accessible Rich Internet Applications (ARIA), and Authoring Tool Accessibility Guidelines (ATAG), Instructure ensures that even the most interactive, dynamic widgets in Canvas are easy to

http://www.instructure.com/canvas-vpat



use with assistive technology such as JAWS (Job Access With Speech) and NonVisual Desktop Access (NVDA).

Instructure continually strives to make Canvas a great experience for all users by ensuring the accessibility of Canvas. Canvas avoids problematic content, such as Flash content, and even converts math equations to MathML automatically. Utilizing the best Web 2.0 technologies and latest standards, Canvas was developed with modern, semantic markup and accessibility techniques. Some of the measures that Instructure takes to ensure the highest level of compliance are

• Client branding assistance to maintain Canvas’s compliance with contrast ratios, styles, and color schemes

• “Alt” tags in system images

• Automatic tags for users’ images in content pane for creating content

• Prompt for “alt text” when embedding external images

• Rich Content Editor only provides styles when formatting text

• Moderation of quizzes for individuals requiring more time or multiple attempts

In regards to N.C.G.S. § 168A-7, Canvas does everything in its power to ensure that it is in compliance with accessibility standards. We realize that accessibility is essential to a student’s success, so we make accessibility a top priority. Please take the time to look over Voluntary Product Accessibility Template (VPAT) http://www.instructure.com/canvas-vpat.

sss) Vendor shall describe their view of the most significant risks they perceive in this project, and how their proposed solution is best suited to mitigate those risks.

The Implementation Manager and Client Services teams work closely with you to identify all risk factors and evaluate their potential impact on the implementation plan and schedule. Risk factors that warrant further evaluation will undergo risk qualification and mitigating or remedial action items will be defined and assigned. Risk qualification addresses the following risk register elements:

• Description of the risk factor or event.

• Schedule Impact. The number of hours, days, week, or months that a risk factor could impact the schedule.

• Scope Impact. The impact the risk will have on the implementation timeline or contract.

• Cost Impact. The impact the risk event, if it occurs is likely to have on the project budget or contract.

At any time during the implementation project, any risk factors or events that your organization identifies or anticipates should be brought immediately to the attention of the Implementation Manager or the Client Services team. Figure 25 lists the inherent implementation risks and the associated mitigation strategies and actions that Instructure takes to ensure a smooth and successful implementation.




Table 7 Implementation Risks and Mitigation

Risk Mitigation Strategy

Content not properly migrated

Instructure extensively tests all content migration scripts to ensure full content portability. If unusual circumstances arise that prevent full automated migration of content, manual insertion of the content into the destination course may be necessary in some cases.

SIS imports not functioning properly

Instructure provides a test cluster environment for the client institution to test all SIS import functions. The environment is available for 60 days and additional time may be purchased if required.

User authentication not functioning properly

Instructure provides a test cluster environment for the client to test user authentication integrations such as LDAP, SAML, and CAS. The environment is available for 60 days and additional time may be purchased if required.

System performance and availability concerns

Instructure continually monitors system performance and availability. In the unlikely event that the system performance degrades or the system becomes unavailable, Instructure will initiate fail-over to redundant resources and the Instructure Support and Engineering teams will analyze and resolve the cause.

Canvas works hard to ensure that our clients are satisfied with the product. We will work hard to ensure that Canvas fits your institution and its needs. Instructure believes that Canvas should empower teaching and learning without burdening teachers and students. Technology is a tool of education, and if we do our work right Canvas, first, stays out of the way, and, second, encourages teachers and learners to innovate and improve their practice. We are here to support you and the best way we can do that is by providing you with a product that works well so you can focus on what is most important, your students’ learning.

Canvas will be your partner as you complete the implementation process. We are with you every step of the way to ensure that everything goes smoothly. Or you can read what one of our first clients said, “If we had to make the decision again, without a doubt, it would be Canvas." - Scott Allen, Learning Systems Admin at UEN after going through the migration process of over 12,000 courses for 110,000 FTE



ttt) Vendor shall describe their suggested metrics for evaluating satisfactory LMS Service performance levels. Which test metrics should be used, and what values would indicate success?

Canvas feels that satisfactory LMS service performance level standards should be set high. Our job is to ensure that you have access to the system. Your students, teachers, and employees need to have a reliable system that is always available. For that reason, we continually monitor the availability and performance of the Canvas service. Service levels are measured in percent of availability; the Master Subscription Services Agreement guarantees 99.9% uptime.

uuu) Vendor shall describe their Project Team Organization and Staffing plan. The Vendor shall designate key personnel to DPI with contact information before execution of the contract.

Melissa Gomez, Regional Director K-12

In the project role of Business Representative, Melissa will be the key contact during the business agreement stage, which formalizes the relationship between Instructure and the NCDPI. Melissa will remain closely involved during the implementation phase and will be the principal contact for inquiries about Instructure’s Professional Services. Melissa’s experience in education ranges from designing, implementing, and maintaining an LMS to providing Canvas demonstrations, customer service, and implementation guidance to new users. Melissa earned her BA in Marketing, from Western Governors University in Salt Lake City, Utah.

Buck Harrison, Manager of Implementation

Buck will be responsible for the execution and monitoring of the implementation plan and schedule. Buck will be the primary point of contact for questions about implementation including technical, on boarding, and integration issues. Buck has over 10 years experience in technical support and implementations. He is classically trained in learning theory and pedagogy emphasizing in design-based research, blended learning, micro-credentials, open education resources, and online education. Buck has a BS in Business Information Systems from DeVry University and an MS in Instructional Psychology and Technology from Brigham Young University. He leads a team of implementation consultants that share this same commitment to excellence in implementing Canvas to each and every institution.

Ike Nelson, Director of Customer Success

Ike will assign and oversee the Customer Success Manager (CSM) who will be the key contact for member contract over the term of the account. Ike will ensure timely and responsive access to Instructure’s support services and other resources. Ike has over nine years of customer service experience in the software industry. Ike received his bachelor’s degree in economics from the University of Utah. Prior to joining Instructure, Ike worked at LANDesk as a Renewal Sales Associate, Channel Program Manager, and Inside Sales Specialist. Ike also worked at Symantec/Altiris as a Sales Operations Specialist.

Seth Johnson, Director of Support



Seth will oversee the on-going technical support. Seth has extensive experience in supervising and managing customer care contact centers. Prior to joining Instructure, Seth worked as the Director of Customer Care & Risk Management at eHarmony, was a Partner at thereNow, and was the Director of Development at Spectrum Research, Evaluation, & Development (SpectrumRED). Seth earned his Master of Science degree in instructional technology at Utah State University.

vvv) The Vendor shall provide a copy of their standard Service Level Agreement (SLA) or support agreement and include notation of optional levels of service. The agreements should include, but not be limited to, 99% uptime on a quarterly basis (no more than 2.19 hours total per quarter of unscheduled downtime); maintenance windows as specified with downtime for maintenance/updates coordinated in advance; availability objectives (including disaster recovery); procedures for reporting incidents to the Vendor (including Vendor support contact information); incident severity classifications and definitions, response times and resolution times, and escalations. The agreements shall include provisions establishing the remedies, such as refunds or service credits, that NCDPI shall be entitled to in the event that Vendor fails to meet the performance metrics established in the agreement.

Instructure guarantees 99.9% system availability and provides full support, rolling updates with no downtime, backups, and data recovery.

Please see our Master Subscription Services Agreement (MSSA) in Appendix B.

www) The Vendor shall provide 24/7/365 support. This shall include system monitoring, responses to unscheduled outages and service inquiries from the designated LMS service manager. The Vendor shall provide a Level 3 response time of 24 hours and a Level 1 response time of 1 hour.

Instructure employs an industry-standard, traditional three-tier technical support methodology for incident reporting, escalation, and resolution. Under Instructure’s Support Package, Tier I support is provided by the institution’s LMS Administrator and Instructure’s Support team provides Tier II and Tier III technical support. Instructure also offers optional Tier I Support that provides live 24/7/365 technical support for the institution’s faculty. Table 8 provides a description of Premium Support that provides 24/7/365 support.

Table 8 Premium Support Package

Premium Support

Tier I Support Faculty Support

Cost 20% of annual

subscription fee or $2,500 minimum

10% of annual subscription fees or

$1,000 total minimum $500 minimum

One-time setup fee



Premium Support


Online Canvas Help Center 24/7/365 24/7/365

Email Support (escalated tickets to Tier

II & III) 8-hour response time 8-hour response time

Toll-Free Phone Support for LMS Admin 24/7/365 24/7/365

Authorized LMS Admin Support Accounts 1 1

All Faculty

*For more than the allotted LMS Admins, an institution will be required to pay $500 per additional LMS Admin.

To provide NCDPI with the highest level of support, Instructure is proposing our Premium Support package. Client institutions that subscribe to the Premium Support package and Tier I Support consistently and enthusiastically report to us that they are extremely satisfied with the value, level of service, and cost-effectiveness of these services. We would be happy to provide additional references of client institutions that subscribe to the Premium and Tier I Support packages.

Tier I Support by Instructure’s Support team provides first-line help desk support to address and resolve faculty issues such as logging into Canvas, questions about Canvas features and functions, and resolving other operational problems.

Instructure Tier I Support requires the purchase of Premium Support as described in Table 8 as well as the setup and per User costs shown in Table 9.

Table 9 Instructure Tier I Support Costs

Description Costs

One-time setup fee $500

Per annual User subscription 10% of annual subscription

$1,000 per year minimum



The institution’s users can contact Instructure’s Tier I Support staff 24/7 through online ticket submission, chat, e-mail, or phone. The institution’s LMS administrator(s) have access to all end-user submitted tickets and monthly usage reports. Instructure’s Tier I Support can be made accessible through the institution’s own branded support portal. Instructure Tier I Support requires the purchase of Premium Support. Table 10 lists Tier I support service levels.

Table 10 Instructure Tier I Support Service Levels

Service Service Level

First contact resolution Greater than 75%

Call abandon rate Less than 10%

Phone 80% of calls answered in 60 seconds or less

Online chat 80% of chat requests answered in 120 seconds or less

Online form – email & help desk ticket response

80% of tickets or emails responded to in 60 minutes or less

The three tier ticket escalation process begins with a support ticket. A reported incident opens a support ticket in Zendesk, the help desk system used by Instructure’s Support team. Tickets are automatically opened when the reporting method is the Help tool, the Canvas Help Center, or email. Tickets are manually opened when reported by phone. Users can track the status of their support tickets 24/7 through the Canvas Help Center.

Tier I

All support tickets are initially routed by Zendesk to Tier I support for resolution. Under Instructure’s Basic, Advanced, and Premium Support package, Tier I support is provided by the local LMS Administrator who is qualified through training and experience to troubleshoot and resolve the majority of user-related incidents. Instructure does offer optional Tier I Support services. Typical incidents resolved by Tier I support include access problems and general usage questions.

Under the Basic and optional Advanced Support Packages, the local LMS Administrator has access to Instructure phone support Monday through Friday, 6am to 6pm Mountain Time. Under the optional Premium Support package, the local LMS Administrator has access to Instructure phone support 24/7/365.

Tier II

If the local LMS Administrator cannot resolve the incident in the established time frame or if the LMS Administrator determines the severity of the incident requires the attention of the Instructure Support



technicians, the LMS Administrator escalates the incident and the associated support ticket is routed by Zendesk to the Support team. Tier II support resolves medium-severity incidents such as performance issues, unexpected system behaviors, administrative questions, and answering design and integration questions.

Tier III

If Tier II support cannot resolve the incident in the established time frame or if the Instructure Support team determines the severity of the incident requires the attention of the Instructure Engineering team, the Instructure Support technicians escalate the incident to Tier III and the associated support ticket is routed by Zendesk to the Instructure Engineering team. Tier III support resolves high-severity incidents such as system failures, code-level related issues, and system bugs.

Please see Table 11 for average response and resolution times based on the urgency and importance of tickets over the last 12 months. The release notes for the past 12 months are available at: http://help.instructure.com/forums/337224-product-release-notes.

Table 11 Support Metrics

Metric Value

Number of upgrades/updates/bug fixes in 12 months1 24

Average response time for urgent needs 26.71 minutes

Average response time for important, but not urgent needs 77 minutes

Average response time for other needs 106.18 minutes

Number of staff working on support/troubleshooting 30

Number of institutions each technical staff person supports 2.23

Average age for a trouble ticket before it is resolved 10.65 hours

Average number of tickets resolved in 24 hours 26%

Number of incidents escalated above Tier I support 7%

Average response time for escalated versus routine issues 14 minutes

Number of tickets resolved in 48 hours 55.82%

Number of all tickets resolved in 4 days or less 70.81%

1 Triweekly release schedule




In addition to the more traditional technical support, the Canvas Help Center provides 24/7/52 web-based support and knowledgebase, accessed directly at http://help.instructure.com or by clicking the Help button in the Canvas interface. The Canvas Help Center contains links to Canvas Guides, as well as to video tutorials, FAQs, user-group specific help, discussion boards, release notes, access to Canvas Communities sites including Google Groups, Facebook, Listserv, Open Source, and client-specific communities.

Instructure continually monitors system performance and availability. In the unlikely event that system performance degrades or the system becomes unavailable, Instructure initiates fail-over procedures to redundant resources. Instructure’s Support and Engineering teams immediately work to analyze and resolve any performance degradation as quickly as possible.

Instructure’s Engineering & Operations team maintains an Outage Log, a record of technical issues with severity beyond the scope of Support technicians; such issues generally affect a significant percentage of users. The Outage Log records data about each issue, including:

Date, time, and duration

Affected system(s)

Steps taken

Root cause

Significant events are reported to LMS administrators automatically (during and after the event) via email; LMS administrators are added to the mailing list by their Account Manager.

xxx) The Vendor shall generate and distribute to the NCDPI monthly status reports including a summary of customer support incidents reported by NCVPS, and, if applicable, LEAs and Charter Schools, the total and incremental number of NCVPS, LEA and Charter School service descriptions for the month, and availability and performance data. The Vendor shall conduct regular conference calls with the NCDPI to review and discuss the performance of Vendor in meeting their responsibilities for delivering the LMS service, notable outages and incidents, efforts to improve on identified problems, and other issues affecting NCVPS, LEA, and Charter School use of the LMS service.

Canvas provides a monthly report of support tickets similar to what is described here; however, this is a service done only for our Tier 1 Support customers. However, everyone has access to Zendesk and can pull the data for themselves. We could definitely help you set up a View in Zendesk that would make it simple to make your own reports that would satisfy this requirement.

Customer Service Managers hold regular status calls with clients to discuss performance, as well as any other concerns that you might have.

http://help.instructure.com/



yyy) The Vendor shall conduct an annual NCVPS, and, if applicable, LEA and Charter School customer satisfaction survey. The content of such survey shall be shared with the NCDPI in advance with input from the NCDPI solicited prior to the distribution of the survey. The results of the customer satisfaction survey shall be shared with the NCDPI.

We perform two sorts of satisfaction surveys three times a year. Product conducts an end-user survey (students and teachers) monthly for users at schools that opt in. At any given school, one ninth of the population is invited to participate each month, such that everybody has an opportunity once a (school) year. The Administrator Survey is given three times a year. Our customer success director has agreed to share the overall scores with you for just the Admins at NCDPI as well as our overall customer base (withholding account/user names, of course).

We do not allow customers to make changes to questions in the standard survey; however, the customer success director would be willing to listen to any feedback or suggestions that you may have.

We do not send out reports of the customer satisfaction surveys. However, you can work with your customer success manager to obtain the raw data results of the surveys. Our long-term plan is to create a database that will create reports and dashboards, but that is not in place yet.

zzz) The Vendor shall describe its experience with large-scale K-12 service deployments.

Canvas currently has over 400 K-12 institutions representing 44% of our client base. Although Instructure has had K-12 clients using Canvas since its initial launch, the Canvas K-12 LMS—designed to meet the unique requirements of the K-12 environment—was publicly announced in February 2012. Canvas’s corporate commitment to supporting and expanding our K-12 client base is backed by a team of employees dedicated to Canvas K-12 product development, sales, and support.

While K-12 schools share many of the same objectives as higher education, there are differences including:

• Organizational structures

• Classroom / instructional paradigms

• Learner traits and behaviors

• Safety and privacy

• Parental involvement

To address these differences, Canvas K-12 provides a comprehensive set of features and functions to meet specific requirements of the K-12 environment including:

Learning Analytics: To meet standards for Adequate Yearly Progress (AYP) under No Child Left Behind, Canvas Learning Analytics can help identify at-risk students, allowing time for teachers and administrators to intervene to help students’ progress. Learning Analytics provides administrators with the tools they need to identify specific students, classes, or schools that need additional resources.



Parents have access to their child's learning analytics profile, which assists the student and parent in identifying specific areas to improve.

Painless Standards Tracking and Reporting: Common Core State Standards (CCSS) can be preloaded in Canvas to provide SDE with the ability to track mastery of CCSS. Canvas makes this mandate painless: simply link the standards and objectives to assignments and quizzes, and the mastery of standards and objectives is tracked automatically as part of the normal grading process. Teachers save time by not duplicating effort and schools don't have to manage a separate reporting system.

Parent Co-Enrollment: Canvas creates a parent account with every student account, including parents by default in all class activities and communication. To protect privacy, parents cannot see other students' work. Parent co-enrollment helps students, parents, and teachers communicate and collaborate for the benefit of the student.

School Interoperability Framework: On April 10, 2014, Canvas announced they would be using School Interoperability Framework (SIF) a new LMS-SIS integration service that is built on open standards. These open standards will reduce the technical challenges for K-12 school districts by simplifying how the LMS and SIS systems communicate (http://www.instructure.com/press-releases/instructure-calls-for-collaboration-in-education-with-new-sif-integration-for-canvas-lms).

One of the ways that Instructure measures the quality of our support to K-12 schools and school districts collectively is the quality of the user experience of individual teachers, students, course designers, and administrators. We regularly survey our customers to ask them why they chose Canvas and if Canvas is meeting their expectations and requirements. Below is a sample of some of the feedback from our K-12 customers:

• “In our evaluation, Canvas outscored all other LMS products. When we tested the product, the interface was very intuitive and it has very tight integration with our Google Apps for Education implementation. The way it integrates, evaluates, and reports learning outcomes is unmatched.”

-Bob Munson, Technology Coordinator, Grundy Center Community Schools • “Rockingham held big expectations for Canvas, and I’ve been extremely pleased with its performance and the reaction of our teachers. Our implementation process has been a huge success; we’re looking forward to a long future with Canvas.”

-Dennis Frye, Dir. of Instructional Tech & Media, Rockingham County School District • “Canvas is powerful software with a simple look and feel. The K-12 product debuted at the top of the charts and is only getting better. Our teachers and students found it very easy to use without any formal training. The Instructure support staff was outstanding helping us integrate our SIS in our Canvas pilot. Canvas is just easy to use.”

-Mike Crawford, Online Learning Assessment & Collaboration Administrator, Sioux City Community Schools

http://www.instructure.com/press-releases/instructure-calls-for-collaboration-in-education-with-new-sif-integration-for-canvas-lms

http://www.instructure.com/press-releases/instructure-calls-for-collaboration-in-education-with-new-sif-integration-for-canvas-lms



To learn more about K-12 success stories, visit http://www.instructure.com/stories-k-12.

aaaa) Vendor shall describe any other features of the proposed LMS service that may not be included in the requirements.

Modules:

The Modules tool provides exceptional flexibility for organizing lessons. Modules can be thematic, focused on a specific topic or content type, or arranged chronologically to provide a course sequence with support for selective release. The Modules tools supports drag-and-drop of module items for easy reordering and reorganization.

Figure 51 Canvas Modules.

Course modules can be selectively released based on release date as well as prerequisites and/or completion requirements based on the content and learning activities in the module. Figure 51 shows the Module Settings interface. Selective release of Modules provides the ability to activate and inactivate entire sets course content and activities.

http://www.instructure.com/stories-k-12



Figure 52 Selective Release of Course Modules

Canvas Modules enforce progression and completion of a course timeline as defined by the instructor. Modules enable instructors to specify prerequisites—including assessment/assignment scores—that support the release of course content based on the satisfactory completion criteria of preceding modules. In addition, assignments, assessments, announcements, discussions, and other classwork and activities can be released and locked based on specified date/times.



Figure 53 Specifying Module prerequisite and completion criteria.

The Module Progress by Student window shows the progress of each learner in a course. The window is split into two columns. The left column lists all learners and shows which module each learner is working on [1]. Click the names of learners to view their progress. Learner progress displays within the right column and shows the state of each module [2].



Figure 54 Module progress by student.

Modules can be completed, in progress, or locked. Modules that have no completion requirements, or modules where the learners have completed the requirements, will be marked as completed. If a learner is in the middle of a module, the module will be marked as “in progress,” and any outstanding requirements can be viewed. If a module cannot yet be accessed by the learner because of completion or prerequisite requirements, the module will be marked as locked.

Canvas also provides user access and activity reports. The course People tool provides a central location for user Access, Interactions, Outcomes, and Grades reports as shown in Figure 55. The Reports tool in the Canvas Administrator’s dashboard includes the following reports: Students with No Submissions, Students Access Report, Last User Access, and Zero Activity.

Figure 55 User reports in the course People tool.

Rich Content Editor

Canvas offers an intuitive, powerful Rich Content Editor that makes incorporating multimedia easy. Multimedia is easily embedded and recorded through Canvas’s Rich Content Editor. The Rich Content Editor embeds and records video, audio, and images. Video and audio can be recorded



directly into the content, using the camera and microphone of the user’s browser-enabled computing or mobile device.

In the Rich Content Editor, icons for YouTube, Flickr, EQUELLA, and other content repositories can be added to the toolbar for easy access to these sources. The simplicity of sharing media makes it easier to make every part of the course more engaging. The Rich Content editor is used to create all types of content including assignments, quizzes, the ePortfolio, pages, etc.

Figure 56 Rich Content Editor Interface

The Experience

It isn’t really one feature that makes Canvas special. It is all of the features working together to allow for creativity and innovation. The one thing that stands out about Canvas is how intuitive and user friendly it is. You can easily create a course in a matter of hours. The other surprising thing is that it is actually fun to create a course in Canvas. The course creation tools in Canvas open up new possibilities for designing course activities, incorporating different types of media, and overall, just engaging students. Nothing can really capture the actual experience of working on Canvas, so we hope that you will give us the opportunity to let you see it in action.



3.1 LMS Desirable Features

These features are desirable, but not required. The Vendor may describe how their service would provide the stated functionality. Please be detailed.

a) Integration with an alert system that includes sending Short Message Service messages. E.g. FAB SMS, Simplified Alerts, etc.

Canvas messaging, announcements, alerts, and notifications are sent to users’ Recent Activity Streams and Inboxes in their Canvas dashboards (which are fully accessible with the mobile apps) as well as to any communication channels specified in individual user’s notification preferences. As a message broker, Canvas transparently routes all messaging and notifications among users, regardless of the destination or delivery mechanism, including forwarding messages and notifications to the mobile-accessible channels as specified in users’ individual notification preferences. Users can specify one or more external communications channels—external email, SMS text, Facebook, Twitter, LinkedIn—for each type of notification and the frequency they want to receive notifications for each communications channel. Canvas notifications can be send to students who score below a certain percentage on a quiz.

b) Integration with an online presentation and feedback tool (webinar).

Canvas Conferences provide webcasting and a collaborative presentation space including audio/video participation, an interactive whiteboard, and synchronous chat as shown in Figure 57. The ability to initiate and invite one or more participants to a Conference is based on the user role permission “Create web conferences.” Canvas Conferences support one-to-one and many-to-many participants for all user types. Conferences with outside participants are supported in public courses.



Figure 57. Canvas Conferences Interface

Conferences can be recorded. Conferences can be time-limited or unlimited for long-running sessions. Presentation materials can be uploaded to the whiteboard which provides a set of drawing tools with different pen widths, colors, geometric shapes, undo function, and eraser. Canvas also supports integrations with third-party lecture capture and conferencing tools including Blackboard Collaborate, Panopto, Echo360, Tegrity, WizIQ, Wimba, MeetingOne, and Adobe Connect.

c) Integration with an instant messaging tool.

Canvas provides a synchronous chat tool that allows course members to type in real-time. In addition, Canvas integrates with several third-party synchronous communication tools such as Cranium Cafe, Hoot.me, Scribbler and VoiceThread. Canvas Chat provides an integrated synchronous chat tool as shown in Figure 58. All users logged into the system and in the same class and/or group can “gather” in the chat room to share video, audio, and text communication using familiar chat elements such as avatars, emoticons, and graphics. The Chat tool maintains a history that instructors can view.



Figure 58. Canvas Chat Interface

d) Integration with third party course registration system. I.e. course catalog.

Canvas offers a course registration system as an optional product at an additional cost.

Catalog incorporates and combines all of the fundamental features and functions of a well-designed website, course catalog, registration and enrollment processor, payment gateway, and certificate authoring engine to be an easy-to-use, out-of-the-box e-commerce solution. For a complete description please refer to Appendix E “Catalog – Registration and Payment Portal” starting on page 148.



4 References

a) The Vendor shall provide three (3) references of customers utilizing the Vendor’s current, fullyimplemented LMS service, preferably in a large-scale K-12 education setting.

b) Please do not provide references from customers using a service other than the one the Vendor is proposing in response to this RFP.

c) For each reference, the Vendor shall provide the following information:

i. Customer name;

ii. Customer address;

iii. Current telephone number of a customer employee most familiar with the project;

iv. Brief summary of the project; and

v. Any other project related information the Vendor believes would be helpful in evaluating this reference.

Contact information for five project references of similar size and complexity are provided in Table 12 through Table 16:

Table 12. Reference: Knox County Schools

Reference

Organization Name

Knox County Schools

Address PO Box 2188, Knoxville, TN 37901

K12 Enrollment 57,326

Contact’s Name Steve Glenn

Contact’s Position Technology Specialist

Contact’s Phone 856.594.1837

Contact’s Email [email protected]

Table 13. Reference: Rock Hill School District 3

Reference

Organization Name

Rock Hill School District 3

Address PO Box 10072, Rock Hill, SC 29731




Reference


Contact’s Name Chris Smith

Contact’s Position Director, Staff Development



Table 14. Reference: Rockingham County Schools

Reference

Organization Name

Rockingham County Schools

Address 511 Harrington Hwy, Eden, North Carolina 27288


Contact’s Name Merea Bridges

Contact’s Position Instructional Technology Specialist



Table 15. Reference: Utah Educational Network

Reference

Organization Name

Utah Educational Network

Address 101 Wasatch Drive, Salt Lake City, Utah 84112

Contracted FTE 34,000

Contact’s Name Scott Allen

Contact’s Position Learning System Admin








Table 16. Reference: Katy ISD – Virtual School

Reference

Organization Name

Katy ISD – Virtual School

Address P.O. Box159, Katy, Texas 77492

Users 59,078 (Contracted for 1000)

Contact’s Name Susan Smith

Contact’s Position E-Learning Coordinator





5 Financial Information

Canvas is financially sound. In addition to building and expanding a profitable client base, Instructure is backed by private investment for stability and growth. Instructure’s principal investors include CEO Josh Coates and the venture capital firms Bessemer Venture Partners, Epic Ventures, and OpenView Venture Partners. Instructure has no pending or known potential litigation or actions that may affect our financial capability.

To protect the interests of investors, Instructure, as a closely held, private corporation, requires the execution of a Non-Disclosure Agreement before providing more specific financial information. A Non-disclosure agreement can be provided upon request.



6 Cost Proposal

1) The cost proposal shall be for the delivery of a fully functioning Production LMS service as described in this RFP and shall be in the format specified below using the LMS Service Cost Template.

The completed LMS Service Cost Template is provided on the following page.

RFP #40-IT00103-14 Vendor ______________________________

Page 20 of 55 04/17/2014

LMS Service Cost Template

Item Cost Description Dollar Amount 1

Section III.4.b-h - Planning, Installation, Integration and Configuration (Production Ready) – Total one time dollar amount

2 Section III.4.a - NCVPS content migration of courses from Moodlerooms Joule and Blackboard Learn [not included in Item 1]

3 Total One Time Costs (sum of items 1 and 2)

4 Annual subscriber fee – the per subscriber per year cost available to NCVPS, all LEAs, and all Charter Schools in North Carolina

5 Scaling Factors for Subscriber Fee Please describe any factors that would affect the annual subscriber fee, i.e. Any price decreases as the subscriber base increases.

Melissa Gomez

$75,000

Melissa Gomez

Included

Melissa Gomez

$75,000

Melissa Gomez

$3.74

Melissa Gomez

Canvas by Instructure

Melissa Gomez

Includes Premium Implementation, Course Migration, 3 Days On-Site training, Multiple days Onsite Implementation and Setup including Authentication Setup, Custom Branding, Premium Support, Marketing support and Adoption Planning.

Melissa Gomez

$3.74/user/year Canvas subscription fee for NC LEAsNCDPI (NCVPS, PD, etc.) will receive Canvas licenses at NO COST (up to 150K total yearly users)All include 24/7/365 Support

Melissa Gomez

Included in Item 1

Melissa Gomez

$3.74/user/year flat-rate subscription fee for NC LEAs.Each LEA will be responsible for paying year-1 implementation feesNCDPI (NCVPS, PD, etc.) will receive Canvas licenses at NO COST (up to 150K yearly users). The implementation fee detailed on line 1 is the only direct cost to NCDPI and includes unlimited storage.

Melissa Gomez

Text

Melissa Gomez

Melissa Gomez

Text

Melissa Gomez

Text

kathryn

Typewritten Text

Please refer to Section 6.1 and Section 6.2 "Canvas Implementation Service Package" for a description of Premium Implementation.

kathryn

Typewritten Text

kathryn

Typewritten Text

kathryn

Typewritten Text

kathryn

Typewritten Text

kathryn

Typewritten Text

kathryn

Typewritten Text

kathryn

Typewritten Text

kathryn

Typewritten Text



6.1 Canvas Subscription Fee Inclusions

Table 17 lists the features and services included in the Canvas subscription fee.

Table 17. Canvas Subscription Inclusions Breakout

Canvas Subscription Inclusions

Comprehensive and Complete Hosting Services

Synchronous/Asynchronous Learning Components

Communication Utilities Migration Tools

Analytics/Reporting Tools Test/Training Instance

Mobile Support and Apps Rubrics & Outcomes

Content Management ePortfolios

Cross-Listing Support PowerSchool Integration Support

SpeedGraderTM and Gradebook Web Conferencing

Unlimited Storage Open API

Analytics Toolset

6.2 Canvas Implementation Service Package

Instructure’s Canvas Implementation Services Packages provide service options to meet each client institution’s implementation requirements—ranging from minimal support and guidance to full project ownership and management by Instructure. The Premium Implementation Service Package is outlined in Table 18 and Table 19.

Table 18. Canvas Implementation Services Packages

Package Services Target Audience

Premium Implementation Services

Instructure leads the project and comes on-site, leveraging proven best practices to ensure the project is driven effectively to a successful conclusion.

Institutions that desire the fastest implementation based on Instructure’s proven best practices and that want Instructure to drive the implementation project.



Table 19. Canvas Implementation Services Package: Services, Duration, and Price

Package Included Services Typical Duration


Canvas production account and test/training instance setup

Weekly call with assigned Implementation Consultant

General implementation assistance with guidance, assistance, and troubleshooting of client-initiated course migrations, third-party tools integrations, and account settings.

Standard Online Training Package comprising remote training webinars: 2 hour Admin, 1 hour Support, 2 hours Instructor training

Sample project plan, access to guides, public courses, and best practices documentation

Authentication integration support with access to guides and assistance troubleshooting client-initiated LDAP, SAML, and CAS integrations

Site branding support with guidance, assistance, and troubleshooting of client-initiated branding

Basic SIS integration support with guidance, assistance, and troubleshooting of client-initiated SIS integration

Support services implementation with creation of Zendesk account(s) for the client, or set up forwarding ticket emails to their existing help desk system, and training on Zendesk management

Implementation Team including project manager, trainer, and technical experts

Weekly project status meeting Standard Online Training Package and three

days of on-site training Import up to 5,000 courses1, implement

4 to 8 weeks (24 weeks max.)




authentication, handle branding, and lead internal marketing activities with Canvas gear to drive adoption

In-person assistance from Implementation Team for SIS integration implementation

1 Supported course migration formats: Blackboard 6-9x export .zip, Blackboard Vista/CE course, WebCT 6+ course, ANGEL export .zip, Moodle 1.9 .zip, Desire2Learn export .zip, and Common Cartridge 1.0/1.1/1.2. Non-supported formats require additional work by Instructure’s Professional Services at additional cost. Migration activities include the automated creation of course shells and the automated import of content that maps to similar Canvas course content types. Quality assurance and any necessary remedial cleanup of migrated courses and course content are the responsibility of the client. Any issues identified will be managed through the standard technical support process. Optionally, Instructure offers course migration, quality assurance, and remedial cleanup services through engagement with Professional Services as specified by an additional statement of work.

6.3 Canvas Training Offerings

Instructure’s online Standard Training Package is included in the one-time implementation fee at no additional cost. The online Standard Training Package comprises the following webinars:

• C1. Admin Training

• C2. Support Training

• C3. Instructor Training Please refer to Table 25 for a listing, descriptions, and costs of Instructure’s Canvas training offerings.

6.4 Canvas Support Packages

To provide NCDPI with the highest level of support, Instructure is proposing our Premium Support package.



Table 20 provides a comparison of the services offered in the support packages offered by Instructure.



Table 20. Canvas Premium Support Package

Premium Support


Cost 20% of annual subscription fee or $2,500 minimum

10% of annual subscription fees or $1,000 total minimum

$500 minimum One-time setup fee

Online Canvas Help Center 24/7/365 24/7/365

Email Support (escalated tickets to Tier II &

III) 8-hour response time 8-hour response time

Toll-Free Phone Support for LMS Admin 24/7/365 24/7/365

Authorized LMS Admin Support Accounts 1 1

All Faculty

1 Additional LMS Administrator support accounts are available for $500.00 per account per year.

6.5 Canvas Tier I Support

To provide institutions with the highest level of support, Instructure highly recommends our optional Premium Support package and Tier I support. Client institutions that subscribe to the Premium Support package and Tier I Support consistently and enthusiastically report to us that they are extremely satisfied with the value, level of service, and cost-effectiveness of these services. We would be happy to provide additional references of client institutions that subscribe to the Premium and Tier I Support packages.

Tier I Support by Instructure’s Support team provides first-line help desk support to address and resolve faculty user issues such as logging into Canvas, questions about Canvas features and functions, and resolving other operational problems.

The institution’s faculty can contact Instructure’s Tier I Support staff 24/7 through online ticket submission, chat, e-mail, or phone. The institution’s LMS administrator(s) have access to all user-



submitted tickets and monthly usage reports. Instructure’s Tier I Support can be made accessible through the institution’s own branded support portal. Table 21 lists Tier I support service levels.

Table 21. Canvas Tier I Support Service Levels

Service Service Level

First contact resolution Greater than 75%

Call abandon rate Less than 10%

Phone 80% of calls answered in 60 seconds or less

Online chat 80% of chat requests answered in 120 seconds or less

Online form – email & help desk ticket response

80% of tickets or emails responded to in 60 minutes or less

2) The Vendor responding to this RFP shall deliver a solution that meets all of the RFP requirements.

Yes, Canvas by Instructure will provide a solution that meets all of the RFP requirements as stated in the proposal.

3) Charges for work performed by any Vendor, subcontractor or agent shall be included in the cost responses.

Instructure is not using any subcontractor or agents.

4) Additional one-time costs shall include:

a) Onboarding of NCVPS – including:

i. Migration of 30 courses/content from NCVPS Moodlerooms Joule to the LMS service

Canvas is proposing Premium Implementation Services, which will provide for the migration of 30 courses/content from NCVPS Moodlerooms Joule to Canvas and additional implementation services.

Table 22 lists the Canvas Implementation Service packages and a description of the service provided.

Table 22. Canvas Premium Implementation Service Package

Package Services


Instructure leads the project and comes on-site, leveraging proven best practices to ensure the project is driven effectively to a successful conclusion.

jbunn

Highlight



Table 23. Canvas Premium Implementation Service Package: Service, and Duration



Canvas production account and test/training instance setup

Weekly call with assigned Implementation Consultant

General implementation assistance with guidance, assistance, and troubleshooting of client-initiated course migrations, third-party tools integrations, and account settings.

Standard Online Training Package comprising remote training webinars: 2 hour Admin, 1 hour Support, 2 hours Instructor training

Sample project plan, access to guides, public courses, and best practices documentation

Authentication integration support with access to guides and assistance troubleshooting client-initiated LDAP, SAML, and CAS integrations

Site branding support with guidance, assistance, and troubleshooting of client-initiated branding

Basic SIS integration support with guidance, assistance, and troubleshooting of client-initiated SIS integration

Support services implementation with creation of Zendesk account(s) for the client, or set up forwarding ticket emails to their existing help desk system, and training on Zendesk management

Implementation Team including project manager, trainer, and technical experts

Weekly project status meeting

4 to 8 weeks (24 weeks max.)

jbunn

Highlight

jbunn

Highlight

jbunn

Highlight




Standard Online Training Package and three days of on-site training

Import up to 5,000 courses1, implement authentication, handle branding, and lead internal marketing activities with Canvas gear to drive adoption

In-person assistance from Implementation Team for SIS integration implementation

1 Supported course migration formats: Blackboard 6-9x export .zip, Blackboard Vista/CE course, WebCT 6+ course, ANGEL export .zip, Moodle 1.9 .zip, Desire2Learn export .zip, and Common Cartridge 1.0/1.1/1.2. Non-supported formats require additional work by Instructure’s Professional Services at additional cost. Migration activities include the automated creation of course shells and the automated import of content that maps to similar Canvas course content types. Quality assurance and any necessary remedial cleanup of migrated courses and course content are the responsibility of the client. Any issues identified will be managed through the standard technical support process. Optionally, Instructure offers course migration, quality assurance, and remedial cleanup services through engagement with Professional Services as specified by an additional statement of work.

iii. Migration of 74 courses from NCVPS Blackboard Learn to the LMS service

Migration of the 74 courses from NCVPS Blackboard Learn to Canvas is provided with the Premium Implementation as shown in Table 23.

5) All one-time costs shall be specified as a firm fixed price.

The one-time cost is provided as a firm fixed price on the pricing sheet.

In addition to the LMS Service, the following additional one-time non-LMS service deliverables shall be provided:

a) Migration of existing NCVPS courses from current LMS service(s) to proposed solution.

i. 30 courses in Moodlerooms Joule service.

Yes, the cost of migrating 30 Moodlerooms Joule courses is included in the price proposal.

ii. 74 courses in Blackboard Learn service.

Yes, the cost of migrating 74 Blackboard Learn courses is included in the price proposal.

b) Technical Implementation Plan.

Please refer to Table 3 “Implementation Plan” on page 28.

jbunn

Highlight

jbunn

Highlight

jbunn

Highlight

jbunn

Highlight



c) Integration with NCLOR

Yes, Canvas has integration with EQUELLA.

i. Teachers must be able to add content from the NCLOR to their course.

Yes, the Canvas and EQUELLA integration supports adding content to courses.

e) Integration with NC IAM Service.

Integration with NC IAM Services would be via the Canvas API. Canvas provides a fully documented, secure, open RESTful API for querying and exporting Canvas data as well as accessing Canvas functionality. Using the API, Canvas data is securely exposed for export in standard CSV or XML format. Exported data can then be imported into various query, reporting, and analysis tools. The documentation for the Canvas API is publicly available at: https://canvas.instructure.com/doc/api/index.html.

i. Single sign-on.


Canvas-internal authentication can be used alone or concurrently with any of the supported external IdPs identified above. For example, when used concurrently with LDAP Canvas first presents user credentials to the external IdP. If authentication fails, Canvas then looks up the credentials using its internal authentication service. If authentication fails again, Canvas will deny the user login.

e) Integration with PowerSchool.

i. Course/class provisioning.

The Canvas implementation service includes the configuration and testing of our turn-key integration with PowerSchool (version 7.2 or later) for one-way creation and synchronization of teacher and student accounts, courses, sections and enrollments. The scheduled synchronization generally occurs nightly at 2:00 AM MST/MDT but can be modified to accommodate the clients needs.

ii. Grade book synchronization.

Instructure is committed to and actively developing grade book synchronization as part of our PowerSchool solution. This future solution will allow teachers to selectively choose which assignments to “Post to SIS” and to synchronize the selected assignments and their associated grades to PowerSchool on demand without the need for manual export/import.

https://canvas.instructure.com/doc/api/index.html

jbunn

Highlight

jbunn

Highlight



f) Plan for onboarding new LEAs or Charter Schools that opt-in to the service.

Please refer to Table 3. Implementation Plan starting on page 28.

i. Include details for current NC LEAs or Charter School customers.

Table 24. Current LEAs or Charter School Customers

Canvas Accounts

Tyrrell County Schools Burke County schools

Charlotte Christian School Perquimans County Schools

Warren County Schools Franklin Academy-North Carolina

North Carolina School of Science and Mathematics (NCSSM) Edenton-Chowan Schools

The NC Center for the Advancement of Teaching Yadkin County Schools

St. Mary’s School Rockingham County Schools

ii. Include training for instructional technologists and teachers.

Canvas has included 3 days of On-site training in the price proposal in addition to Canvas’s online Standard Training Package comprises the following webinars:



• C3. Instructor Training

g) Capacity testing plan, testing, and final report ensuring the service can meet uptime and access requirements.

Please refer to Appendix B “Master Subscription Services Agreement” for uptime and access requirements.

h) Communication and marketing plan/recommendations.

Canvas provides excellent examples of communication and marketing plans that other districts have used to help rollout Canvas please refer to Canvas Strategies.

http://j.mp/CanvasStrategies

jbunn

Highlight



7 Conflict of Interest

i. Provide a statement that no assistance in preparing the response was received from any current or former employee of the State of North Carolina whose duties relate(d) to this RFP, unless such assistance was provided by the state employee in his or her official public capacity and that neither such employee nor any member of his or her immediate family has any financial interest in the outcome of this RFP;

We received no assistance from any current or former employees of the State of North Carolina in preparing our response to RFP No.40-IT00103-14.

ii. State if the Vendor or any employee of the Vendor is related by blood or marriage to an Agency employee or resides with an Agency employee. If there are such relationships, list the names and relationships of said parties. Include the position and responsibilities within the Vendor's organization of such Vendor employees; and

No Instructure employees are related by blood or marriage to an Agency employee and no Instructure employees reside with an Agency employee.

iii. State the employing State Agency, individual’s title at that State Agency, and termination date.

N/A



8 Vendor’s Additional Terms and Conditions

Notwithstanding anything to the contrary contained in the RFP or Instructure’s proposal response to the RFP, should Instructure be awarded the contract, Instructure will negotiate in good faith the terms and conditions of a written agreement mutually satisfactory to both parties. Instructure believes, however, that any agreement should recognize that:

1. Canvas, Instructure’s fully hosted learning management system (LMS), is provided as a subscription cloud service over the Internet.

2. Instructure requires full payment of annual subscription fees in advance.

3. Instructure considers an RFP to be the specification of a client institution’s functional and technical requirements for an LMS. Our proposal response is a detailed description of how the Canvas LMS and education technology platform and Instructure’s support and hosting services satisfy the RFP’s requirements. Because the client institution’s RFP and Instructure’s proposal response are not structured, organized, or written in terms of rights and obligations of the parties, Instructure does not automatically incorporate those documents into the final contractual agreement. Instructure is, however, open to negotiations to identify relevant portions of the RFP and the proposal response for the mutually agreed upon inclusion of such portions within the final agreement.

In creating our Master Subscription Services Agreement (MSSA) which is provided in Appendix B, Instructure has ensured that the rights and protections of both parties are addressed and clearly delineated in a mutually beneficial and balanced agreement. In our MSSA, we have incorporated clauses that reflect the best practices of the cloud-based subscription software industry including:

a) Service level agreement with credit/refund language,

b) Family Educational Rights and Privacy Act (FERPA) compliance and the “school official” exception,

c) Confidentiality of information provided by the institution,

d) Ownership of content provided by the institution, and

e) Return of content and data to the institution.

Instructure’s Master Subscription Services Agreement (MSSA) provides rights and protections to both our clients and to Instructure. The MSSA governs the delivery of the subscription Canvas cloud service, support terms, warranties, infringement indemnity, compliance terms (including FERPA), service level agreement, data ownership, use of subcontractors, and other standard terms and conditions for an agreement of this type.

A copy of our Master Subscription Services Agreement is provided in Appendix B.



9 Errata and Exceptions

Instructure acknowledges North Carolina Department of Public Instruction’s RFP contains language limiting the ability to add to or modify the proposed terms and conditions, however Instructure believes these terms and conditions do not cover all the intricacies regarding a Software as a Service (SaaS) offering.

Please refer to Section 8 and Appendix B for Exceptions.



10 Copy of Vendor’s License and Maintenance Agreements

Please refer to Appendix B “Master Subscription Services Agreement.”



11 Other Supporting Material Including Technical System Documentation

The Canvas Help Center can be accessed by clicking the Help button in the Canvas interface or directly at http://help.instructure.com. The Canvas Help Center is available 24/7/365 to administrators, faculty, and students. It contains links to Canvas Guides, video tutorials, FAQs, user-group specific help, discussion boards, release notes, and Canvas Communities sites, including Google Groups, Facebook, Listserv, Open Source, and client-specific communities.

Canvas Guides are an extensive set of user and technical documentation. The categories of Canvas Guides include:

Getting Started Canvas Student Quickstart Guide Canvas Instructor Quickstart Guide Canvas Student Guide Canvas Observer Guide Canvas Instructor Guide Canvas Designer Guide Canvas Admin Guide Canvas Video Guide

The Canvas Help Center also includes online training delivered as video tutorials, text-based tutorials, new release screencasts, and Canvas courses.

Figure 59. Canvas Help Center



12 Training and Other Materials, Samples or Examples

Instructure is offering 3 days of onsite training included in the cost proposal. Instructure’s online Standard Training Package is included in the implementation services packages at no additional cost. The online Standard Training Package comprises the following webinars:



• C3. Instructor Training

Instructure’s Training team will customize onsite employee training to meet the District’s requirements. Please refer to Figure 25for a listing and descriptions of Instructure’s training offerings.

Table 25. Canvas Training Offerings Menu

In-Person/On-site

A1. Face-to-Face Training

Duration: 1 or more days Cost: $3,000 per day

plus travel expenses

Can be held at Instructure’s Salt Lake City office or on-site at any location. Institutions choose from a variety of hands-on workshop and presentation topics to create a personalized training agenda. A typical day of training includes six hours.

Online (asynchronous)

B1. Intro to Canvas for Instructors – Online Course

Duration: 2 weeks Cost:

1 – 20 people: $150 per seat 21 – 40 people: $140 per seat 41 – 55 people: $130 per seat 56 – 65 people: $120 per seat 66 and up: $100 per seat

Introduces instructors to Canvas fundamentals and provides an opportunity to build and configure a course step-by-step. Participants learn how to navigate the Canvas interface, customize courses, create a syllabus, upload files, create assignments and quizzes, use assessment tools, and more.

Webinars (real-time)

C1. Admin Training Duration: 2 hours Cost: Initial included,

additional $600

Instructs LMS Admins how to configure the administrative settings in Canvas. Participants learn how to manage users, sub-accounts (domains),

jbunn

Highlight



courses and enrollments, as well as how to organize courses, manage users and permissions and create shared content that can be used by teachers.

C2. Support Training

Duration: 1 hour Cost: Initial included,

additional $300

Teaches local support personnel how to troubleshoot problems and support end users. Participants will learn how to utilize Canvas documentation, interact with the user community and effectively use the help ticketing system.

C3. Instructor Training

Duration: 2 hours Cost: Initial included,

additional $600

Provides instructors with an overview of basic Canvas functionality, including account settings, notification preferences, messaging students, uploading files, editing pages, customizing the course navigation and building assignments. Participants also learn the basics of quizzes, discussions, analytics and grading.

C4. Canvas Essentials Training

Duration: 1 hour Cost: $300

Introduces all types of users to the Canvas interface. This session includes a descriptive tour of Canvas features followed by a more in-depth look at how to build courses and manage course settings.

C5. Canvas Course Design Training


Provides instructors with sample design strategies they can use to organize assignments, discussions, quizzes and content into an easy-to-navigate course. Participants will also learn how to use Canvas assessment tools and analytics.

C6. Assessment & Grading Training


Introduces instructors to features they can use to provide assessment, feedback and grades to students. Participants learn how to use Outcomes, Rubrics, SpeedGrader™



and the Gradebook.

C7. Migration Strategies Training


Prepares instructors and/or support personnel to move existing course content from other learning management systems to Canvas. Participants learn how to import content and discuss migration strategies employed by other Canvas users. This webinar is best suited for institutions preparing to migrate from Blackboard Learn or Blackboard Vista.

C8. Collaboration Training


Introduces instructors to collaboration features in Canvas, including discussions, group assignments, Canvas Collaborations and Conferences. Participants will discuss how these tools can be used to enhance their class activities.

C9. Course Delivery Training


Prepares instructors who will facilitate pre-designed courses in Canvas. Participants will learn how to adjust account settings, navigate the Canvas interface, grade student work, manage the course roster, access Canvas support and communicate with their students.

C10. Training Strategies


Introduces training strategies used by other Canvas community members. Participants compare and discuss the needs of their institution and explore which training initiatives might work best for them. They also learn about the training materials and opportunities provided by Instructure and the greater Canvas community.

C11. Canvas Open Q&A Session

Duration: 2 hours Cost: $600

Designed for client stakeholders to ask specific questions about Canvas related to their institution’s specific needs. One hour of the session is customized to the institution. Additional



topics covered may include, but are not limited to, peer review, student groups, grades and reporting, assessment, analytics, LTI tools and admin functionality.

Canvas Authorized Trainer Program (CAT)

The Canvas Authorized Trainer Program (CAT) provides a professional development opportunity for education technology professionals to formalize their continued learning of the Canvas learning platform. The program’s three levels motivate participants to connect with a larger network of trainers and to develop and deliver training that will best suit the needs of their local learners.

D1. Level 1 CAT Preparation Course

Duration: Ongoing Cost: No fee (open

enrollment)

Challenges trainers to demonstrate intermediate mastery of Canvas fundamentals. Participants build a Canvas course, develop training deliverables, deliver and reflect on live training sessions and log 40 hours learning about Canvas and engaging with the Canvas Community.

D2. Level 2 CAT Curriculum Course

Duration: 8 weeks Cost: $1,500

Prepares trainers who have completed the Level 1 CAT Preparation Course to demonstrate an advanced mastery of Canvas fundamentals as they develop local training sessions based on template workshop materials.

D3. Level 3 CAT Renewal Course

Duration: Ongoing Cost: $500

Provides trainers with an opportunity to demonstrate their ongoing mastery of Canvas 12 months after achieving Level 2 status. To maintain Level 3 status, participants are required to submit an annual log of hours spent learning Canvas. They are also encouraged to publicly share an ePortfolio with evidence of their expert training skills.

Theme-based Training Packages

E1. Package 1: Maximizing Canvas

Cost: $900 Includes these webinars: Canvas Course Design (1 hour), Assessment & Grading Training (1 hour) and



Collaboration Training (1 hour).

E2. Package 2: Corporate Partner

Cost: $1,200 Includes these webinars: Canvas Course Design (1 hour), Course Delivery Training (1 hour) and Canvas Open Q&A Session (2 hours).

E3. Package 3: Train Your Trainers

Cost: $1,200 Includes these webinars: Assessment & Grading Training (1 hour), Migration Strategies Training (1 hour), Course Delivery Training (1 hours) and Canvas Open Q&A Session (2 hours).

E4. Package 4: Faculty Ultra

Cost: $1,200 Includes these webinars: Canvas Essentials (1 hour), Canvas Course Design (1 hour), Assessment & Grading Training (1 hour) and Canvas Open Q&A Session (2 hours).

Volume Pricing Packages

F2. Jumpstart Package

Cost: $6,000 (discounted $1,000)

Includes these training options: 20 seats in Intro to Canvas for Instructors Online Course (2 weeks), 2 sessions of Instructor Training (2 hours each), 2 sessions of Collaboration Training (1 hour each), 1 session of Course Delivery Training (1 hour), 1 session of Assessment & Grading Training (1 hour) and 2 sessions of Canvas Open Q&A Session (2 hours each).

F3. Premium Package

Cost: $10,000 (discounted $2,450)

Plus actual travel costs for Face-to-Face training

Includes these training options: 1 Face-to-Face training session, 30 seats in Intro to Canvas for Instructors Online Course (2 weeks), 2 sessions of Canvas Essentials (1 hour each), 2 sessions of Canvas Course Design (1 hour each), 2 sessions of Assessment & Grading Training (1 hour each), 1 session of Migration Strategies Training or Training Strategies (1 hour), 2 sessions of Collaboration Training (1 hour each), 3 sessions of Canvas Open Q&A Session (2 hours



each) and 1 Canvas Authorized Trainer credit.



13 RFP Attachment 6 Responses

Attachment 6 Responses are provided on the following page.

All questions in Attachment 6 must be completed by the Vendor and returned as part of the Vendor RFP response. Vendors may provide other information by category to assist in demonstrating the level of architectural consistency.

1) Scalability:

a) Provide detailed diagrams with complimenting narrative describing proposed technical solution.

The Canvas architecture is a single instance, multi-tenant system designed to scale to tens of millions of users. The Canvas "stack" is a dynamic scaling web application built with our own automated scaling and automated provisioning technologies. Canvas is developed using Ruby on Rails and is built on:

• The Ubuntu LTS operating system • Apache2 + Passenger web and application server • Cassandra and Redis NoSQL store and caching • PgBouncer and PostgreSQL transactional database

Canvas is hosted on the state-of-the-technology cloud infrastructure provided by Amazon Web Services (AWS). The AWS services used to host Canvas include Elastic Compute Cloud (EC2), Elastic Load Balancing (ELB), Simple Storage System (S3), Elastic Block Store (EBS), Virtual Private Cloud (VPC), Simple Email Service (SES), CloudFront, Identity and Access Management (IAM), DirectConnect, and CloudSearch. All application nodes are hosted on the AWS EC2 and S3 infrastructure, making full use of the real-time redundancy and capacity capabilities offered. Virtualization is provided by AWS EC2.

All data traffic in and out of Canvas is at least 128-bit SSL-encrypted. The AWS cloud infrastructure is SAS70 Type II audited, Service Organization Controls 1 (SOC 1) reported and published under both the SSAE 16 and the ISAE 3402 professional standards, ISO 27001 certified, Level 1 service provider under the Payment Card Industry (PCI) Data Security Standard (DSS), and has achieved FISMA-Moderate operation level. Instructure uses three AWS regions: the US East (Northern Virginia) Region with 5 EC2 Availability Zones, the US West (Oregon) Region with 3 EC2 Availability Zones, and the EU West (Ireland) Region with 3 EC2 Availability Zones.

AWS data center electrical power systems are designed to be fully redundant and maintainable without impact to operations, 24 hours a day, and seven days a week. Uninterruptible Power Supply (UPS) units provide back-up power in the event of an electrical failure for critical and essential loads in the facility. Data centers use generators to provide back-up power for the entire facility.

Data is stored redundantly in multiple data centers and multiple geographic regions across the country through Amazon S3. The Canvas architecture replicates data in near real-time and data is backed up



on a daily basis. Instructure creates daily offsite database backups of Canvas data and content including media, file system data, course structures, coursework, analytics, rubrics, learning outcomes, and metadata. Any restore of the system will not result in more than 10 minutes of data loss.

The Canvas architecture is horizontally scalable, enabling it to respond to usage spikes in real-time and to accommodate expanded, long-term usage. Canvas architecture also provides exceptional resilience to and rapid recovery from component failure. The Canvas application, its media and file storage, and its database are each independently redundant. If an application hosting node were to fail, all traffic would transfer to living nodes. If load increases, Canvas's automated provisioning system ensures that more hosting nodes are made available—either in response to increased load or in anticipation of it—to handle it. The database and file stores are also horizontally scalable, adding capacity for both additional storage and load as needed.

The tiers of the Canvas architecture—Load Balancers, Application Servers, Caching, Database, Distributed File Store, and Rich Media Store—are described below:

Figure xx. Canvas Architecture



b) Describe the largest production implementation by an existing customer that utilizes the proposed technical solution.

On June 15, 2012 Instructure formalized a partnership with Cisco Networking Academy, which operates in nearly 2,000 high schools, colleges, and universities across the United States, as well as an additional 8,000 institutions in 165 countries around the world. The more than one million Cisco Networking Academy students are using Canvas for its blended face-to-face and web-based curriculum for the Cisco Certified Network Associate (CCNA), and Cisco Certified Network Professional (CCNP) certifications, among others.

The reasons Cisco selected Canvas are in large measure the same reasons Canvas is an ideal fit for NCDPI; an open education platform, built with technology native to the cloud that integrates easily with other technologies and external providers, and is compatible with all primary operating systems and major web browsers.

c) Describe the testing methodology used in the development of the proposed technical solution (e.g.

Performance, Load, Stress, Security, etc.).

Instructure continually tests performance, load, stress, and security capabilities to ensure reliability and sustainability across all spectrums of Canvas.

Instructure’s security team conducts quarterly internal security audits of the Canvas code base and Instructure’s production environment. Intrusion and penetration vulnerabilities are tested in Instructure's internal quarterly security audits to render Canvas both secure and hardened against Internet susceptibilities. Instructure employs attack prevention tools, including a network firewall, anti-virus software, vulnerability scanning, penetration testing, encryption, and authentication and authorization protection to discover vulnerabilities and protect the network from Internet attacks.

Regular vulnerability scans of the Canvas application and infrastructure are also conducted using third-party tools, custom scripts, and open source tools. If any vulnerabilities are detected, Instructure’s security and engineering teams work together to analyze, design, and develop the required patch. Security-related patches to the operating system, application software, and libraries are applied within one (1) week, except in high severity cases, where patches are applied within twenty-four (24) hours by best commercial efforts. In most cases, the vulnerability can be fixed using a hot patch without incurring any downtime whatsoever to the Canvas production environment.

External vulnerability and penetration testing reports can be found at: http://help.instructure.com/forums/20382721-security-notices

All components of the Canvas product are also included in the test approach.

The scope of product testing includes:

Unit Testing – Validation of individual units of product code.

http://help.instructure.com/forums/20382721-security-notices



Integration Testing - Verifies function and reliability of the product code as it relates to database and the web interface.

Functional Testing - Verifies that each feature of the application meets its requirements. For example, a “Create Course” button should trigger the appropriate event when pressed.

User Acceptance Testing - Verifies that the product/project works in the customer expected manner. It is critical that datasets and data are either identical or similar to customer/project data, execution, scope and scenarios.

Performance Testing - Ensures that the system meets defined response times. Load Testing - Creates a load greater than the expected customer demand on the system. Bash - Ad-hoc testing in an attempt to find flaws and break the system. Multi-User Testing - Similar to load testing but assures that an acceptable number users can

work within the system simultaneously. Scenario Testing - Identifies customer scenarios that may not have been tested in previous

test cycles and processes. Product Certification - Certification by the QA team that the product/project meets objectives

and requirements of the test plan.

Instructure applies an Agile testing methodology with an integrated Quality Assurance (QA) process to the design, development, and maintenance of Canvas. Every day during the three-week cycle, Instructure’s Engineering team holds a “stand-up” meeting to review progress and discuss any concerns. Engineers write automated unit and integration tests to cover all new code that is written. In addition, all code changes are run through the full Canvas QA test suite before they can be accepted into the main product. Code changes are closely reviewed and must be peer-approved by other Engineering team members before inclusion in the upgrade/update package.

After the three-week development cycle, all changes are deployed to an internal staging server for additional QA testing. Instructure’s QA team reviews all associated tickets, uses black-box testing of affected components, and also test standard application workflows. Notes are made on the internal tickets for these changes as needed. Any bugs that are found must be fixed during this QA period, otherwise the change is pulled for further development.


Preliminary release notes are generated for the upcoming release and made available to all users at http://help.instructure.com/forums/337224-product-release-notes

Current and past release notes for the tri-weekly Canvas upgrade/update releases are available at http://help.instructure.com/forums/337224-product-release-notes.

Past security notices for Canvas are available on the Security Advisory Forum of the Canvas Community at https://help.instructure.com/forums/20382721-Security-Notices.



https://help.instructure.com/forums/20382721-Security-Notices



d) Describe the ability of the proposed solution to scale both horizontally and vertically.

Canvas has the ability to scale both horizontally and vertically when necessary.

Canvas scales horizontally through continually tuned automated provisioning, adapting as necessary to use appropriate resources to meet fluctuating demands in system traffic. This method of horizontal scaling saves time, resources, and cost while eliminating the need to maintain an unnecessarily high system capacity or to manually monitor traffic. (See 1e. for additional details)

Canvas also has the capability to scale vertically by increasing the instance size through the auto-scaling capabilities of Amazon Web Services.

e) Describe how the proposed solution can be scaled to manage pilot, rollout, and growth rate requirements.

The Canvas architecture is a single instance, multi-tenant system, designed to scale to tens of millions of users as demand and system load fluctuates from pilot, rollout, and accelerated growth rates.

Canvas achieves this performance through continually tuned automated provisioning. Automated provisioning utilizes optimal computing resources through the early detection and accommodation of usage spikes. When a spike is detected, system power is allocated among multiple servers to ensure efficient operations even during peak usage times such as the start and end of academic terms.

Traditionally, provisioning computing capacities follow either a fixed model, where an organization is forced to choose a fixed computing capacity upfront, or a Application Server Provider model (ASP), where traffic must be manually monitored allocated to accommodate system load.

Figure xx. Fixed Provisioning Infrastructure



Figure xx. On-demand Provisioning Infrastructure

Canvas offers a better provisioning solution. As the only hosted LMS with a true, native cloud implementation, Instructure’s state-of-the-art architecture utilizes automated provisioning which, as the name suggests, automatically provisions computing resources in response to actual usage.

Figure xx. Instructure Automated Provisioning

Automatic provisioning is able to accommodate to peak usage times to maintain a positive and consistent user experience. As system load increases, so too does the available system capacity, and as usage decreases, automatic provisioning releases unnecessary capacity to create both a cost-efficient solution and extra savings for NCDPI.



2) Adaptability:

a) Describe the overall architectural approach utilized to design the proposed solution (e.g. Service Oriented, 3/N Tier, Composite Application).

Canvas is a single instance multi-tenant system developed using Ruby on Rails. Canvas utilizes the Ubuntu LTS operating system, Apache2 + Passenger web and application server, Cassandra and Redis NoSQL store and caching, and the PgBouncer and PostgreSQL transactional database.


All data traffic in and out of Canvas is 128-bit SSL-encrypted. The AWS cloud infrastructure is SAS70 Type II audited, Service Organization Controls 1 (SOC 1) reported and published under both the SSAE 16 and the ISAE 3402 professional standards, ISO 27001 certified, Level 1 service provider under the Payment Card Industry (PCI) Data Security Standard (DSS), and has achieved FISMA-Moderate operation level. Instructure uses three AWS regions: the US East (Northern Virginia) Region with 5 EC2 Availability Zones, the US West (Oregon) Region with 3 EC2 Availability Zones, and the EU West (Ireland) Region with 3 EC2 Availability Zones.

b) Describe how the architectural approach and the technologies used enable solution adaptability.

Canvas’s architectural approach allows it remain innovative, adaptable, compatible, and relevant to today’s programming standards.

While other legacy Learning Management systems were developed using outdated programming protocols, Canvas was crafted from the ground up using modern tools and programming standards. This approach allows Canvas to adapt quickly to new learning or teaching models, incorporate new ideas and learning management approaches, maintain a consistent programming standard, and remain at the forefront of innovation and education.

As a cloud-hosted solution, Canvas is versionless and naturally keeps all users up-to- without the need for time consuming updates or user-installed patches. This architectural approach keeps Canvas secure, adaptable, and provides all users with the same framework for collaboration, creation, and communication.

Additionally, Canvas is an open source learning management system. As an open source solution, Canvas is optimized for open standards. This allows designers and creators to easily add third-party additions and functionality to enhance the Canvas experience to best address their needs through LTI and API integration.



Finally, Canvas does not require Java, and uses a minimalistic approach to flash. This architectural approach allows for greater utility and adaptability and allows teachers and users to connect across multiple platforms and devices.

c) Describe the technology roadmap for the proposed solution.

Instructure is dedicated to the future of Canvas and invests 39.3% of its revenue into development and research initiatives. This commitment to the future has led to the pioneering of many new features and forced competitors to replicate Instructure’s innovations. Pioneered features include: SpeedGrader, drag-and-drop functionality, personal notifications, course copy auto-dates, Google Docs integration, and more.

An updated technology roadmap for Canvas can be found at: http://product.instructure.com/

d) Describe how the solution will be capable of adapting to meet changing business requirements.

Canvas was created to meet the needs of an ever-changing and evolving marketplace through a dedication to research and development, open-sourced architecture designed around easy third-party integration, and dynamic scalability manufactured to expand to the demands of the industry.

That’s why Canvas is—and will continue to be—the most adaptable, flexible, and innovative platform available.

3) Secureability:

a) Describe how the solution can be deployed to provide layered access controls.

Canvas is at least 128-bit SSL-protected, ensuring that both inbound and outbound traffic, including any sensitive or personally-identifiable information, is encrypted and secured.

Though Instructure recommends external authentication into Canvas when possible, Canvas supports internal authentication (username and password) and several forms of delegated authentication. Internal authentication can be used concurrently with any form of delegated authentication. If desired, credentials from any third-party system can be synchronized with Canvas via its open API. Even when external authentication is configured, accounts can be setup to utilize the internal authentication mechanism.

Canvas also integrates with Single Sign-On (SSO) and federated authentication service providers, including LDAP, Active Directory, CAS, and SAML/Shibboleth (as well as OpenID if it's being passed through a gateway IdP such as SAML) to support centralized password/authentication administration.

Canvas internal authentication for secure user logon can additionally be used concurrently with any form of delegated authentication.

Local authentication passwords must be 6 or more characters. Passwords created for Canvas-internally authenticated users, are never stored. Passwords are securely hashed via the SHA-512 cryptographic hash algorithm with a randomly generated "salt" value. The resulting “signature” and

http://product.instructure.com/



“salt” are then stored. When Canvas-internal users attempt to authenticate, their credentials are passed through the same process and the resulting signature is checked against the stored signature. This process is exclusively uni-directional and passwords cannot be derived from their stored signature.

Canvas provides a consistent, end-to-end security infrastructure responsible for protecting all content provided in and through the Canvas system. Access to user information, courses, course content, files, and more is restricted by enrollment type and specific permissions. These permissions are fully configurable by the institution's administrators and can differ between districts, schools, and other levels of institutional hierarchy.

In addition to system-wide security, faculty can configure and manage the security of their courses' content. Content, including assignments, files, discussions, and more can be "locked" by the faculty to prevent student access.

b) Describe how the solution can be deployed to accommodate both an integrated or externalized identity access and management solution.


Canvas-internal authentication can be used alone or concurrently with any of the supported external IdPs identified above. For example, when used concurrently with LDAP, Canvas first presents user credentials to the external IdP. If authentication fails, Canvas then looks up the credentials using its internal authentication service. If authentication fails again, Canvas will deny the user login.

Canvas clients are encouraged to use Canvas in concert with their preferred external idP in order to best control and establish end-user security protocols. For Canvas-internal authentication, passwords must be 6 or more characters. Passwords are never stored in plain text. Passwords are securely hashed via the SHA-512 cryptographic hash algorithm with a randomly generated "salt" value. The resulting signature and salt value are then stored. When users attempt to authenticate, their credentials are passed through the same process and the resulting signature is checked against the stored signature. This process is exclusively uni-directional and passwords cannot be derived from their stored signature.

c) Describe the ability of the proposed solution to meet federal and state regulatory requirements.

Canvas was built to comply with the Family Educational Rights and Privacy Act (FERPA) by design and readily integrates with other campus systems to prevent unauthorized access to FERPA-protected data. Whether implemented as a standalone system or as a fully integrated component of



the campus IT/IS infrastructure, Canvas provides educational institutions and agencies with multiple mechanisms and technologies to manage, enforce, and comply with the provisions of FERPA and to fulfill their responsibilities under its requirements.

Additionally, the Canvas education technology platform and learning management system is hosted on the state-of-the-technology cloud infrastructure provided by Amazon Web Services (AWS). The AWS infrastructure is highly stable, fault-tolerant, and secure as attested by the following certifications:

Statement on Auditing Standards No. 70 (SAS 70) Type II audited Service Organization Controls 1 (SOC 1) reported and published under both the Statement on

Standards for Attestation Engagements 16 (SSAE 16) and the International Standard on Assurance Engagements 3402 (ISAE 3402) standards

Certified ISO/IEC 27001:2005 Information technology – Security techniques – Information security management systems – Requirements

Level 1 service provider under the Payment Card Industry (PCI) Data Security Standard (DSS) Federal Information Security Management Act (FISMA) Moderate Authorization and

Accreditation received from the U.S. General Services Administration.

For additional information about AWS security certifications and standards compliance, please refer to http://aws.amazon.com/security and http://aws.amazon.com/compliance/

4) Availability:

a) Describe the technologies and approach used to meet and/or exceed availability requirements.

Canvas is a versatile LMS that’s available on desktops, laptops, tablets, and mobile devices. Canvas supports the latest two versions of Apple Safari, Google Chrome, Microsoft Internet Explorer, and Mozilla Firefox and leverages the best and newest capabilities they provide.

The Canvas mobile app offers a rich user experience and provides a clean, intuitive, and reliable interface to submit assignments, take quizzes, check grades, and participate in discussions and learning activities. Students and faculty can further utilize the app to communicate and collaborate through Canvas Conversations, keep up-to-date with assignments, quizzes, and announcements, and provide and discuss feedback through text, audio, and their mobile device’s video functionality.

http://aws.amazon.com/security

http://aws.amazon.com/compliance/



Figure xx. Canvas Android App

b) Describe an acceptable backup and recovery approach to meet and/or exceed availability requirements

Canvas client data is backed-up automatically both in real-time and on a 24 hour schedule to multiple geographic locations, rather than a single data center. This allows Instructure to provide superior disaster recovery in the case of outages.

Most structured data—courses, user information, and assignments, for example—is stored in a PostgreSQL database. This data is horizontally partitioned between instances based on account and demand. Each database cluster has a Master and a Slave database, located in geographically separate sites. The data from each Master is replicated asynchronously in near-real time to its corresponding Slave. Each Master is also backed up completely every 24 hours, and the backup is stored in a third geographically separate site. Files for static assets from courses and assignments are stored on a scalable, protected, geographically redundant storage system (Amazon S3). Multiple copies are stored by Instructure for backups.

5) Manageability:

a) Describe the versioning and patch management process for the proposed solution.

Canvas is a versionless cloud-hosted solution and automatically keeps all users up to date without downtime (99.9% uptime guarantee), time consuming updates, or user-installed patches. This



approach keeps Canvas secure, adaptable, and provides all users with the same framework for collaboration, creation, and communication.

b) Describe approaches that could be implemented to provide overall performance monitoring for the proposed solution.


Canvas leads the industry with a 99.9% uptime guarantee. Further, Canvas is developed using an agile methodology applying bug and security updates faster than non-cloud native platforms. On average, Instructure takes only three weeks to apply bug fixes (other platforms generally take three to six months to develop and apply fixes). Because Canvas is a cloud native platform, fixes for severe issues can be released immediately without waiting for a scheduled release.

c) Describe the Quality Assurance (QA) measures that have been taken in the design, implementation, and maintenance with respect to the proposed solution.

Instructure applies an Agile methodology with an integrated Quality Assurance (QA) process to the design, development, and maintenance of Canvas. Every day during the three-week cycle, Instructure’s Engineering team holds a “stand-up” meeting to review progress and discuss any concerns. Engineers write automated unit and integration tests to cover all new code that is written. In addition, all code changes are run through the full Canvas QA test suite before they can be accepted into the main product. Code changes are closely reviewed and must be peer-approved by other Engineering team members before inclusion in the upgrade/update package.

After the three-week development cycle, all changes are deployed to an internal staging server for additional QA testing. Instructure’s QA team reviews all associated tickets, uses black-box testing of affected components, and also test standard application workflows. Notes are made on the internal tickets for these changes as needed. Any bugs that are found must be fixed during this QA period, otherwise the change is pulled for further development.


Instructure additionally tests the functionality, reliability, and capabilities of Canvas product upgrades and updates on supported web browsers and native mobile apps. The QA process comprises three stages:

• Test Approach Definition - to establish the overall strategy and scope of testing.

• Test Requirements & Planning - to identify the activities, dependencies, effort, and resources required to achieve test approach.



• Test Development and Execution - to manage and conduct the testing including:

o Maintain test plan and schedule

o Design unit, automated, and manual test cases to be run

o Define the data required for tests

o Create test environment

o Execute tests through the testing scope and the testing cycles

o Signoff when exit criteria have been met

The QA process is a dynamic process. As new requirements are identified, corresponding unit tests, integration tests, regression tests, and all requisite test cases will be created.

d) Describe the management and monitoring tools that are supported by the proposed technologies.


Instructure’s Engineering & Operations team maintains an Outage Log, a record of technical issues with severity beyond the scope of Support technicians; such issues generally affect a significant percentage of users. The Outage Log records data about each issue, including:

• Date, time, and duration

• Affected system(s)

• Steps taken

• Root cause

Significant events are reported to LMS administrators automatically (during and after the event) via email; LMS administrators are added to the mailing list by their Account Manager.

6) Interoperability:

a) Describe the programming language(s) and development framework(s) that are utilized in the design and implementation of the proposed solution.

Canvas is developed using Ruby on Rails built on:

• Ubuntu LTS operating system

• Apache2 + Passenger web and application server

• Cassandra and Redis NoSQL store and caching

• PgBouncer and PostgreSQL transactional database




b) Describe any open (industry and/or de facto) standards utilized to ensure interoperability of this solution within a heterogeneous environment.

Instructure’s approach and commitment to commercial open source makes us unique in the LMS industry. We believe that open source is a critical part of the future of educational software. Closed systems propagate vendor lock-in that inhibits innovation and prevents instructors and students from taking advantage of the full potential of open web standards-based education technologies.

Canvas’s open, standards-based architecture supports compatibility or integration with any third-party application, tool, or service that provides an open, standards-based technology integration, connectivity, or content interchange such as LTI or Common Cartridge. Instructure’s Professional Services team and our client institutions have designed and developed LTI-based integrations with digital library systems and materials, electronic reserve systems, and research databases. Canvas also provides out-of-the-box support for EQUELLA, a leading digital resources repository and management system.

c) Describe the available options, along with the preferred approach, for integrating the proposed solution with other intra/inter agency systems and NC Shared Services.

Canvas was specifically designed to integrate easily with a variety of academic and administrative systems including Student Information Systems (SIS)/Student Information Management Systems (SIMS), Enterprise Resource Planning (ERP) systems, and Human Resources Information Systems (HRIS). Canvas supports integrations with Ellucian (formerly SunGard Banner or Datatel Colleague), PeopleSoft, Jenzabar, CampusVue, Poise, PowerSchool, CampusKey, and other SIS/ERP/HRIS that can export data that can be translated into the Canvas SIS data import format or sent directly to the Canvas SIS application programming interface (API).

Canvas accepts SIS data in standard comma separated-values (CSV) and IMS Enterprise XML formats. The following links detail the specifications for API-based SIS import:

• Canvas API General: https://api.instructure.com

• SIS Imports via API: https://canvas.instructure.com/doc/api/sis_imports.html

• Canvas standard CSV: https://canvas.instructure.com/doc/api/file.sis_csv.html

https://api.instructure.com/

https://canvas.instructure.com/doc/api/sis_imports.html

https://canvas.instructure.com/doc/api/file.sis_csv.html



d) Describe the flexibility of this solution to meet future integration needs.

In order to facilitate the most integrations with the greatest flexibility possible, Canvas provides a robust open API that securely expose Canvas data and functionality using REST. All API access is over HTTPS using OAuth2 authentication. All API responses are in JavaScript Object Notation (JSON) or CSV.

e) Describe how the solution meets accessibility (i.e. W3C and/or 508) requirements.

Canvas adheres to accessibility guidelines of Section 508 of the Rehabilitation Act as documented in our Voluntary Product Accessibility Template (VPAT) publicly available at http://www.instructure.com/canvas-vpat.

By using W3C's Web Accessibility Initiative (WAI) Web Content Accessibility Guidelines (WCAG) 2.0 AA, Accessible Rich Internet Applications (ARIA), and Authoring Tool Accessibility Guidelines (ATAG), Instructure ensures that even the most interactive, dynamic widgets in Canvas are easy to use with assistive technology such as JAWS (Job Access With Speech) and NonVisual Desktop Access (NVDA).

Instructure continually strives to make Canvas a great experience for all users by ensuring the accessibility of Canvas. Canvas avoids problematic content, such as Flash content, and even converts math equations to MathML automatically. Utilizing the best Web 2.0 technologies and latest standards, Canvas was developed with modern, semantic markup and accessibility techniques. Some of the measures that Instructure takes to ensure the highest level of compliance are:

• Client branding assistance to maintain Canvas’s compliance with contrast ratios, styles, and color schemes

• “Alt” tags in system images

• Automatic tags for users’ images in content pane for creating content

• Prompt for “alt text” when embedding external images

• Rich Content Editor only provides styles when formatting text

• Moderation of quizzes for individuals requiring more time or multiple attempts

7) Enterprise:

a) Describe how the proposed solution can leverage NC Shared Services.

Canvas was specifically designed to integrate easily with a variety of academic and administrative systems including Student Information Systems (SIS)/Student Information Management Systems (SIMS), Enterprise Resource Planning (ERP) systems, and Human Resources Information Systems (HRIS). Canvas supports integrations with Ellucian (formerly SunGard Banner or Datatel Colleague), PeopleSoft, Jenzabar, CampusVue, Poise, PowerSchool, CampusKey, and other SIS/ERP/HRIS that can export data that can be translated into the Canvas SIS data import format or sent directly to the Canvas SIS application programming interface (API).




b) Describe how consolidation of services and infrastructure will be accomplished.

As a cloud-hosted solution, Canvas does not require a consolidation of services or infrastructure.



Instructure’s Terms and Conditions

Instructure acknowledges North Carolina Department of Public Instruction’s RFP contains language limiting the ability to add to or modify the proposed terms and conditions, however Instructure believes these terms and conditions do not cover all the intricacies regarding a Software as a Service (SaaS) offering.

Notwithstanding anything to the contrary contained in the RFP or Instructure’s proposal response to the RFP, should Instructure be awarded the contract, Instructure will negotiate in good faith the terms and conditions of a written agreement mutually satisfactory to both parties. Instructure believes, however, that any agreement should recognize that:

1. Canvas, Instructure’s fully hosted learning management system (LMS), is provided as a subscription cloud service over the Internet.

2. Instructure requires full payment of annual subscription fees in advance.

3. Instructure considers an RFP to be the specification of a client institution’s functional and technical requirements for an LMS. Our proposal response is a detailed description of how the Canvas LMS and education technology platform and Instructure’s support and hosting services satisfy the RFP’s requirements. Because the client institution’s RFP and Instructure’s proposal response are not structured, organized, or written in terms of rights and obligations of the parties, Instructure does not automatically incorporate those documents into the final contractual agreement. Instructure is, however, open to negotiations to identify relevant portions of the RFP and the proposal response for the mutually agreed upon inclusion of such portions within the final agreement.

4. Because the MSSA provides for penalties if specified service levels are not met, Instructure does not provide payment or performance bonds.

In creating our Master Subscription Services Agreement (MSSA) which is provided following this page, Instructure has ensured that the rights and protections of both parties are addressed and clearly delineated in a mutually beneficial and balanced agreement. In our MSSA, we have incorporated clauses that reflect the best practices of the cloud-based subscription software industry including:

a) Service level agreement with credit/refund language,

b) Family Educational Rights and Privacy Act (FERPA) compliance and the “school official” exception,

c) Confidentiality of information provided by the institution,

d) Ownership of content provided by the institution, and

e) Return of content and data to the institution.



Instructure’s MSSA provides rights and protections to both our clients and to Instructure refer to Appendix B. The MSSA governs the delivery of the subscription Canvas cloud service, support terms, warranties, infringement indemnity, compliance terms (including FERPA), service level agreement, data ownership, use of subcontractors, and other standard terms and conditions for an agreement of this type.



Appendix B. Master Subscription Services Agreement

Instructure’s Master Subscription Services Agreement is provided following this cover page.

Rev. 03.01.14

1

Master Subscription Services Agreement This agreement is between Instructure, Inc., a Delaware corporation (Instructure), and the entity or individual agreeing to these terms and identified in the signature line below (Customer). It is effective as of the date of the last signature set forth below.

LEARNING MANAGEMENT SYSTEM SOFTWARE SERVICE. With a signed order, Instructure will provide its learning management system software as a service through a URL within a hosted server environment under the terms below (Service). This agreement contemplates one or more orders for the Service, which are governed by the terms of this agreement. User means a participant, instructor, or administrator of Customer’s organization, who is authorized by Customer to use the Service (and Customer has paid for this use) with login credentials.

(1) USE OF SERVICE.

a). Customer Owned Content. All information, data, results, plans, sketches, texts, files, links, images, photos, videos, audio files, notes, or other materials uploaded under Customer’s User accounts in the Service remain the sole property of Customer, as between Instructure and Customer (Customer Content). Customer grants Instructure the worldwide, royalty-‐free right to use, publicly display, and distribute the Customer Content solely for purposes of performing its obligations under this agreement and providing and improving the Services. During the term of this agreement and for 3 months after expiration or termination, Customer may export the Customer Content through the API or by using the export feature within the Service. Instructure has no obligation to store the Customer Content 3 months after expiration or termination.

b). API Access. Instructure provides access to its application-‐programming interface (API) as part of the Service for no additional fee.

Subject to the other terms of this agreement, Instructure grants Customer a non-‐exclusive, nontransferable, revocable license to operate the API only for purposes of interfacing Customer’s technology applications or services with the Service as allowed by the API’s technical limitations and in accordance with the API Policy, as may be updated by Instructure from time to time. The Instructure API Policy is located at http://www.instructure.com/policies/api-‐policy

c). Customer Responsibilities. Customer (i) is solely responsible for Customer Content and all activities arising from its User accounts in

the Service, (ii) must keep its passwords secure and confidential, and notify Instructure promptly of any known or suspected unauthorized access, and (iii) may use the Service only in accordance with applicable law and regulation.

d). Customer Restrictions. Customer may not, and will use reasonable means to ensure that each User does not,

i. sell, resell, rent, or lease the Service or API; ii. reverse engineer the Service or the API; iii. remove or modify any proprietary marking or restrictive legends in the Service; iv. use the Service to store or transmit infringing, unsolicited marketing emails, libelous, obscene, deceptive, defamatory, pornographic,

racist, sexual, hateful, or otherwise objectionable (except as necessary for Customer’s instructional purposes, but in all cases in compliance with applicable law and regulation), unlawful or tortious material, or any other material in violation of a third-‐party right;

v. use the Service to harm or impersonate any person, or for any commercial purpose (including accessing the Service to build a competitive service or product, or copy any feature, function or graphic for competitive purposes);

vi. interfere with or disrupt the integrity or performance of the Service; or vii. attempt to gain unauthorized access to the Service or their related systems or networks.

e). Customer Support. Instructure must provide customer support for the Service under the terms of Instructure’s Customer Support

(Support), which are located at http://www.instructure.com/policies/support-‐terms. (2) PAYMENT TERMS.

Customer must pay all fees as specified on the order, but if not specified then within 30 days of receipt of an invoice. Customer is responsible for the payment of all sales, use and other similar taxes. All orders are non-‐cancelable and the fees are non-‐refundable (except as expressly provided below).

(3) WARRANTY/SERVICE LEVEL AGREEMENT AND REMEDY. a). Compliance with Laws. Each party represents and warrants to the other party that it will comply with all applicable laws and

regulations (including all applicable export control laws and restrictions) with respect to its activities under this agreement. Instructure will implement reasonable and typical administrative, technical, and physical safeguards in an effort to secure its facilities and systems from unauthorized access and to secure the Customer Confidential Information (defined below) and data. Instructure agrees to only use or disclose personal information records created or received from, by, or on behalf of Customer or its Users for the purposes of (a) providing and improving the Services and in accordance with the Instructure Privacy Policy, except that Instructure may create, use, and disclose de-‐identified and aggregated data based upon personal information records for its own purposes, (b) as permitted by this agreement, (c) as required by law or regulation, or (d) as authorized by Customer in writing. Notwithstanding the

Rev. 03.01.14

2

foregoing, Instructure may access, preserve, and disclose User’s registration and any other information if required to do so based on Instructure’s good faith belief that such access, preservation, or disclosure is necessary to: (i) enforce this agreement; (ii) respond to claims of a violation of the rights of third parties, whether or not the third party is a User, individual, or government agency; (iii) respond to customer service inquiries; or (iv) protect the rights, property, or personal safety of Instructure, other users or the public.

b). Service Availability Warranty. Instructure warrants to Customer, (i) that commercially reasonable efforts will be made to maintain the online availability of the Service for a minimum availability in a trailing 365-‐day period as provided below (excluding scheduled outages, standard maintenance windows, force majeure, and outages that result from any technology issue originating from Customer or a User), (ii) the functionality or features of the Service may change but will not materially degrade during the Term, and (iii) that Support may change but will not materially degrade during the Term. Annual Availability Warranty: 99.9% availability percentage

• If Customer has been using the Service for less than 365 days, the preceding 365 days will be used, but any days prior to Customer’s use of the Service will be deemed to have had 100% availability.

• Any unavailability occurring prior to a successful credit claim cannot be used for any future claims.

A Customer is eligible for a service credit if the annual availability percentage drops below 99.9% for the preceding 365 days from the date of a service credit claim. The maximum amount of the credit is 1/12 of the annual subscription fee for a twelve (12) month period. This service credit is calculated by taking the number of hours that the Service was unavailable below the warranty, and multiplying it by 3% of 1/12 the annual subscription fee. Customer’s sole and exclusive remedy for breach of the warranty in this Section 3(b)(i) will be for Instructure to provide a credit as provided above; provided that Customer notifies Instructure in writing of such claim within the applicable month Customer becomes eligible or 30 days after.

c). Third Party Links/Service Disclaimer. The Service may link to third party web sites (including without limitation, links provided by Users of the Service) or allow access to third-‐party services (including without limitation, turnitin.com and Google docs). Such sites and services are not under the control of Instructure, and Instructure is not responsible for the content or any link on such sites or for the temporary or permanent unavailability of such third party sites or services.

d). Warranty Disclaimer. EXCEPT AS EXPRESSLY PROVIDED IN THIS SECTION, INSTRUCTURE DISCLAIMS ALL WARRANTIES, WHETHER

WRITTEN, ORAL, EXPRESS, IMPLIED, OR STATUTORY, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY, TITLE, NON-‐INFRINGEMENT, AND FITNESS FOR A PARTICULAR PURPOSE. COMPANY DOES NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED OR BE ERROR-‐FREE.

(4) MUTUAL CONFIDENTIALITY.

a). Definition of Confidential Information. Confidential Information means all confidential information disclosed by a party (Discloser) to the other party (Recipient), whether orally or in writing, that is designated as confidential or that reasonably should be understood to be confidential given the nature of the information and the circumstances of disclosure (Confidential Information).

b). Protection of Confidential Information. The Recipient will protect the Confidential Information using the same degree of care that it

uses to protect the confidentiality of its own Confidential Information (but in no event less than reasonable care). The Recipient shall not disclose or use any Confidential Information of the Discloser for any purpose outside the scope of this agreement. The Recipient must make commercially reasonable efforts to limit access to Confidential Information of Discloser to those of its employees and contractors who need such access for purposes consistent with this agreement and who have signed confidentiality agreements with Recipient no less restrictive than the confidentiality terms of this agreement.

c). Exclusions. Confidential Information excludes information that: (i) is or becomes generally known to the public without breach of any obligation owed to Discloser, (ii) was known to the Recipient prior to its disclosure by the Discloser without breach of any obligation owed to the Discloser, (iii) is received from a third party without breach of any obligation owed to Discloser, or (iv) was independently developed by the Recipient without use or access to the Confidential Information. Notwithstanding any of the foregoing, the Recipient may disclose Confidential Information to the extent required by law or court order, but will provide Discloser with advance notice to seek a protective order.

(5) PROPRIETARY RIGHTS.

a). Reservation of Rights by Instructure. The software, workflow processes, user interface, designs, know-‐how, API information, third party technology and other technologies provided by Instructure as part of the Service are the proprietary property of Instructure and its licensors, and all right, title and interest in and to such items, including all associated intellectual property rights, remain only with Instructure and its licensors. Instructure reserves all rights unless expressly granted in this agreement.

b). Feedback. Instructure may contact each User (no more than once each year) for the sole purpose of seeking feedback regarding

performance of the Service and suggestions for improvements (such feedback will be stored in anonymous and aggregate form). Customer, and each User (to the extent Customer has such right), hereby grants Instructure an irrevocable, royalty-‐free perpetual license to use all feedback and suggestions regarding the Service.

Rev. 03.01.14

3

(6) EXCLUSION OF DAMAGES AND LIMITATION OF LIABILITY. a). EXCLUSION OF CERTAIN DAMAGES. INSTRUCTURE AND ITS SUPPLIERS SHALL NOT BE LIABLE TO CUSTOMER FOR ANY INDIRECT,

SPECIAL, EXEMPLARY, PUNITIVE, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF OR RELATED TO THIS AGREEMENT OR THE USE OR INABILITY TO USE THE SERVICES (INCLUDING, WITHOUT LIMITATION, COSTS OF DELAY, LOSS OF DATA, RECORDS OR INFORMATION, AND ANY FAILURE OF DELIVERY OF THE SERVICE), EVEN IF INSTRUCTURE HAS BEEN NOTIFIED OF THE LIKELIHOOD OF SUCH DAMAGES.

b). LIMITATION OF LIABILITY. EXCEPT FOR INSTRUCTURE’S INTELLECTUAL PROPERTY INDEMNITY OBLIGATIONS IN SECTION 9, INSTRUCTURE’S MAXIMUM LIABILITY FOR DAMAGES ARISING OUT OF OR RELATED TO THIS AGREEMENT (WHETHER IN CONTRACT, TORT OR OTHERWISE) SHALL NOT EXCEED THE AMOUNT PAID BY CUSTOMER WITHIN THE PRECEDING 12 MONTHS UNDER THIS AGREEMENT.

(7) TERM, TERMINATION, AND SUSPENSION OF SERVICE.

a). Term. This agreement continues for the duration specified on the order (Term).

b). Mutual Termination for Material Breach. If either party is in material breach of this agreement (including without limitation non-‐

payment of any amounts owed Instructure), the other party may terminate this agreement at the end of a written 30-‐day notice/cure period, if the breach has not been cured.

c). Return or Destroy Upon Termination. Upon termination or expiration of this agreement for any reason, Customer must pay

Instructure all amounts owed, and destroy or return all property of Instructure. Customer will confirm this destruction or return requirement in writing upon request of Instructure.

d). Suspension of Service and Removal of Customer Content for Violations of Law or Policy. Instructure may immediately suspend

the Service and remove applicable Customer Content if it in good faith believes that, as part of using the Service, Customer and/or its Users may have violated a law or a restriction in this agreement. Instructure may try to contact Customer in advance, but it is not required to do so.

(8) GOVERNING LAW AND FORUM.

This agreement is governed by the laws of the State of Utah, without regard to conflict of law principles. Any dispute arising out of or related to this agreement may only be brought in the state and federal courts for Salt Lake County, UT. Both parties consent to the personal jurisdiction of such courts and waive any claim that it is an inconvenient forum. Nothing in this agreement prevents either party from seeking injunctive relief in a court of competent jurisdiction. The prevailing party in any litigation is entitled to recover its attorneys’ fees and costs from the other party. The Convention on Contracts for the International Sale of Goods does not apply to this agreement.

(9) INFRINGEMENT INDEMNITY.

a). By Instructure. If a third-‐party claims that the Service (other than related to any Customer Content) infringes that party's U.S patent,

copyright or other proprietary right, Instructure will defend Customer against that claim at Instructure’s expense and pay all costs, damages, and attorney's fees, that a court finally awards or that are included in a settlement approved by Instructure, provided that Customer:

i. promptly notifies Instructure in writing of the claim; and ii. allows Instructure to control, and cooperates with Instructure in, the defense and any related settlement.

If such a claim is made, Instructure may continue to enable Customer to use the Service or to modify it such that it becomes non-‐infringing. If Instructure determines that these alternatives are not reasonably available, Instructure may terminate the Service without any liability to Customer upon notice to Customer and with the return of any prepaid and unused fees. The infringement indemnity obligations in this Section 9(a) does not apply to the extent the infringement claim arises from (a) any technology not provided by Instructure or otherwise identified by Instructure in writing as interoperable, (b) use of the Service other than in accordance with this agreement and the applicable Services documentation, (c) the Customer Content, and/or (d) modification or alteration to the Services by anyone other than Instructure.

b). By Customer. If a third-‐party makes a claim against Instructure that any part of the Customer Content infringes or violates a patent, trademark, trade secret, copyright or other intellectual property right, Customer will defend Instructure against that claim at Customer’s expense and pay all costs, damages, and attorney's fees, that a court finally awards or that are included in a settlement approved by Customer, provided that Instructure:

i. promptly notifies Customer in writing of the claim; and ii. allows Customer to control, and cooperates with Customer in, the defense and any related settlement.

(10) MISCELLANEOUS OTHER TERMS.

Rev. 03.01.14

4

a). Money Damages Insufficient. Each party acknowledges and agrees that any threatened or actual breach by a party of this agreement

or violation of the other party’s intellectual property rights could cause irreparable injury or harm to the other party for which monetary damages would be an inadequate remedy. In such case, the other party may seek a court order, without the requirement of posting bond, to stop any breach or avoid any future breach.

b). Entire Agreement and Changes. This agreement and the corresponding orders constitute the entire agreement between the parties, and supersede all prior or contemporaneous negotiations, agreements and representations, whether oral or written, related to this subject matter. No modification or waiver of any term of this agreement is effective unless both parties sign it.

c). Publicity. Customer agrees to act as a reference account that will, upon Instructure’s reasonable request, provide Service-‐related

comments to the press, potential investors, and current or prospective customers and participate in Service-‐related case studies. Customer agrees to issue joint press releases with Instructure regarding the Service, as approved by Instructure. Customer agrees to allow Instructure to use its name, logo and non-‐competitive use details in both text and pictures in its various marketing communications and materials, in accordance with Customer’s trademark guidelines and policies.

d). No Assignment. Neither party may assign or transfer this agreement or an order to a third party, except that this agreement with all

orders may be assigned as part of a merger, or sale of all or substantially all of the business or assets, of a party.

e). Independent Contractors. The parties are independent contractors with respect to each other. f). Enforceability. If any term of this agreement is invalid or unenforceable, the other terms remain in effect and the invalid or

unenforceable provision will be deemed modified so that it is valid and enforceable to the maximum extent permitted by law.

g). No Additional Terms. Instructure rejects additional or conflicting terms of any Customer form-‐purchasing document.

h). Order of Precedence. If there is an inconsistency between this agreement and an order, the order prevails.

i). Survival of Terms. Any terms that by their nature survive termination or expiration of this agreement, will survive (including, but not limited to, Sections 4, 5, 6, and 9).

j). Notices. For purposes of service messages and notices about the Service, Instructure may place a banner notice or send an email to an

email address associated with an account. It is the User’s responsibility to ensure that a current email address is associated with their account.

k). Force Majeure. Any delay in the performance of any duties or obligations of either party (except the payment of money owed) will not

be considered a breach of this agreement if such delay is caused by a labor dispute, shortage of materials, fire, earthquake, flood, or any other event beyond the control of such party.

_____________________________________________(Customer) Instructure, Inc. _____________________________________________ ______________________________________________ Signature Signature _____________________________________________ ______________________________________________ Name Name _____________________________________________ ______________________________________________ Title Title _____________________________________________ ______________________________________________ Date Date _____________________________________________ 6330 South 3000 East, Suite 700 Address Salt Lake City, UT 84121



Appendix C. Disaster Recovery

Canvas’s Disaster Recovery Plan and Procedures is provided following this page.

Instructure Engineering and Operations

Disaster Recovery Plan and Procedures

Instructure, Inc. 17 January 2014

17 January 2014 Instructure, Inc. i

Disaster Recovery Plan and Procedures Instructure Engineering and Operations

TABLE OF CONTENTS 1 Disaster Recovery Plan and Procedures ...................................................................................... 2

1.1 Policy and Practices .......................................................................................................... 2

1.1.1 Definition of Disaster ................................................................................................... 2

1.1.2 Declaration of Disaster ................................................................................................ 2

1.2 Key Organizational Resources .......................................................................................... 2

1.2.1 Disaster Recovery Team ............................................................................................. 2

1.3 Notification ........................................................................................................................ 3

1.3.1 Notifying Staff .............................................................................................................. 3

1.3.2 Notifying Clients and Business Partners ...................................................................... 3

1.3.3 Testing ........................................................................................................................ 3

1.4 Disaster Recovery Solution ............................................................................................... 3

1.4.1 Current Operating Infrastructure .................................................................................. 3

1.4.2 Objectives ................................................................................................................... 4

1.4.3 Backup and Recovery Practices .................................................................................. 5

1.5 Sample Disaster Scenarios ............................................................................................... 6

1.6 Complete Loss of a Master Database ............................................................................... 6

1.7 Simultaneous Complete Loss of Master and Slave Databases ......................................... 6

1.8 Database Destruction by Hacker....................................................................................... 6

1.9 Complete Loss of Primary Hosting Facility ........................................................................ 7

17 Jaunary 2014 6330 South 3000 East, Salt Lake City, UT 84121 • 800.203.6755 2


1 DISASTER RECOVERY PLAN AND PROCEDURES This document describes the plan and procedures that Instructure has established to recover from disasters affecting its production operations. We describe how Canvas has been architected to recover from disaster scenarios, the steps to be taken when disasters are declared, the policies regarding notification of partners during disasters, and several example scenarios and how they affect the service. Our disaster recovery procedures address events which would affect an entire facility. Failures of individual components are recovered through architectural redundancies and fail-over mechanisms.

1.1 Policy and Practices

1.1.1 Definition of Disaster

A disaster is defined as any disruptive event that has potentially long-term adverse effects on the Instructure service. In general, potential disaster events will be addressed with the highest priority at all levels at Instructure. Such events can be intentional or unintentional, as follows:

• Natural disasters: Tornado, earthquake, hurricane, fire, landslide, flood, electrical storm, and tsunami.

• Supply systems: Utility failures such as severed gas or water lines, communication line failures, electrical power outages/surges, and energy shortage.

• Human-made/political: Terrorism, theft, disgruntled worker, arson, labor strike, sabotage, riots, vandalism, virus, and hacker attacks.

1.1.2 Declaration of Disaster

All potential disasters will be escalated immediately to the Director of Operations. The Director of Operations is responsible for assessing the event and confirming the disaster. Once the disaster is declared, the Director of Operations is responsible for directing recovery efforts and notifications.

1.2 Key Organizational Resources

1.2.1 Disaster Recovery Team

The Disaster Recovery Team (DRT) is made up of key engineers and operations employees. The responsibilities of the DRT include:

• Establish communication between the individuals necessary to execute recovery

• Determine steps necessary to recover completely from the disaster

• Execute the recovery steps

• Verify that recovery is complete

17 Jaunary 2014 Instructure, Inc. 3


• Inform the Director of Operations of completion

1.3 Notification

There are several parties that must be notified at various stages during disaster events.

1.3.1 Notifying Staff

The Director of Operations is responsible for making sure the DRT and any other necessary staff are notified of a disaster event and mobilized. Notification of staff will generally happen via cell phone.

1.3.2 Notifying Clients and Business Partners

Clients and business partners will be notified at various stages of disaster recovery by the Director of Operations via email. If email is unavailable, notification will happen via alternative methods (cell phone, etc.) according to the agreements established with each client institution. The stages of notification are:

• Disaster Declaration: When a disaster is declared the notification will include a description of the event, the effect to the service, and any potential impact to data.

• Completion of Recovery: Once recovery is complete and the service is available, the notification will include general information about steps taken to recovery, and any data that may have been impacted. If the recovery is partial and the service is still in a degraded state, this notification will include an estimate of how long the degradation will continue.

1.3.3 Testing

A Disaster Recovery Plan is only useful insofar as it is tested regularly. The Director of Operations is responsible for ensuring that the plan is tested in its entirety at least annually and in part whenever major components are changed.

1.4 Disaster Recovery Solution

1.4.1 Current Operating Infrastructure

Canvas is based on a multi-tier cloud-based architecture. Each component is redundant with active monitoring for failure detection and failover. The different tiers are:

1.4.1.1 Load Balancers

All web traffic to .instructure.com is served by two load balancers in an active/passive configuration. The load balancers are responsible for directing traffic to the next tier.



1.4.1.2 App Servers

App servers process incoming requests from clients from the load balancers. App servers implement all the business logic, but do not persist any important data. Asynchronous jobs also run on the app servers. The number of app servers varies based on demand, but will always be at least two in active/active configurations.

1.4.1.3 Caching

To improve website performance, Canvas aggressively caches data in a caching layer. The data stored here is strictly a performance cache. Any data loss resulting from the loss of any of these servers would be limited toa small number of page views that may not have been flushed to persistent storage. The number of cache servers is variable and the cache data will be partitioned among all servers.

1.4.1.4 Databases

Most structured data—courses, user information, and assignments, for example—is stored in a databases. This data is sharded between instances based on account and on demand. Each shard has a Master and a Slave database, located in geographically separate sites. The data from each Master is replicated asynchronously in near real-time to its corresponding Slave. Each Master is also backed up completely every 24 hours, and the backup is stored in a third geographically separate site. The infrastructure also includes an internal database proxy layer for the relational databases that enables the Operations team to perform maintenance on the relational database servers with mimimal downtime.

1.4.1.5 Third-Party Object Store

Content—such as documents, PDFs, audio, and video—is stored in a third-party scalable object store.

1.4.2 Objectives

In the context of a disaster recovery scenario, there are two terms which are commonly used to describe how the data may be affected: Recovery Time Objective (RTO) and Recovery Point Objective (RPO). The RTO is how long it will take to make access to the data available again, and the RPO is how much of the most recent data will be preserved. For example, if it takes 12 hours for a service to recover, but on a failure up to 24 hours of data may be lost, the RTO is 12 hours and the RPO is 24 hours.

The Canvas platform has been architected to achieve an exceptionally low RPO and RTO in the common case. The goal for a disaster scenario for both RPO and RTO is 24 hours. This 24-hour RPO and RTO, as well as other RPO and RTO estimates provided in this plan, are



extremely conservative upper-end estimates. In actual practice, the Operations team expects much lower RPO and RTO times.

1.4.3 Backup and Recovery Practices

The Operations team keeps a skeleton infrastructure running in disaster recovery regions which is ramped up for scale, a process normally performed every morning as load increases. Backup and recovery practices for specific assets are described below.

Instructor, student, course, assignment data from database

Backup Data is replicated asynchronously in near real-time to remote site (monitored, etc.). Nightly backups of every database are stored in third remote site.

Recovery When slave is caught up:

• Promote slave database to master, following replication docs

• Provision new database using provisioning tools

• Establish new database as new slave, following replication docs

When slave is > 24 hours behind

• Copy last nightly backup to slave database

• Load slave with nightly backup

• Provision new database using provisioning tools

• Establish new database as new slave, following replication docs

Static assets from courses and assignments such as documents and other content files

Backup Files are stored on a scalable, protected, geographically redundant storage system (Amazon S3). Multiple copies are stored by Instructure which provide the backups.

Recovery Recovery in case of failures is built into the scalable storage system.

Web applications

Backup Web application source code is stored in versioned source control and backed up to multiple locations. There is no state stored on the application servers that would need to be backed up.

Recovery Not applicable.



1.5 Sample Disaster Scenarios

Following are several different possible disaster scenarios and their RPO/RTO, services affected, and recovery overview. Note that these are intended only to convey magnitude of impact and recovery efforts required under different situations.

1.6 Complete Loss of a Master Database

Services Affected Most accounts hosted on the affected database.

Recovery Overview • When the slave database is up-to-date (common case): The slave is promoted to be the new master according to the steps described above.

• When the slave database is inconsistent: The slave is populated with the latest nightly snapshot and brought online as the new master.

RPO 5 minutes (consistent slave, common case), 24 hours (inconsistent slave)

RTO 1 hour (consistent slave, common case), 6 hours (inconsistent slave)

Likelihood Once a year

1.7 Simultaneous Complete Loss of Master and Slave Databases


Recovery Overview • New master and slave databases are brought online in separate locations.

• The master database is populated with data from the offsite backup.

• App servers pointed to new master database.

• Replication re-established with the new slave database.

RPO 24 hours

RTO 6 hours

Likelihood Once every 20 years (the master and slave databases are hosted in geographically separate locations, which makes simultaneous failure very unlikely)

1.8 Database Destruction by Hacker


Recovery Overview • The master database is restored from the most recent complete backup.

• Replication is re-established with the slave database.

RPO 24 hours



RTO 6 hours

Likelihood Once every 10 years

1.9 Complete Loss of Primary Hosting Facility

Services Affected LMS for most accounts.

Recovery Overview • New load balancers and app servers are brought up in the secondary site with the slave database.

• The old slave database is promoted to master database.

• A new database slave is brought up at a third site and replication re-established.

• DNS is pointed to the new load balancers at the recovery site and services are restored.

RPO 4 hours

RTO 24 hours

Likelihood Once every 10 years



Appendix D. Canvas Security

The Instructure Security, Engineering, and Operations document is provided following this cover page.

Instructure Security, Engineering, and Operations

Canvas Security

Instructure, Inc. 6 May 2014

6 May 2014 Instructure, Inc. 1

Canvas Security Instructure Security, Engineering, and Operations

TABLE OF CONTENTS 1 Canvas Security Infrastructure ............................................................................................. 3

1.1 AWS Network Security ............................................................................................. 3

1.2 AWS Services .......................................................................................................... 4

1.3 AWS Regions and Data Centers .............................................................................. 4

1.4 AWS Data Security .................................................................................................. 4

2 Canvas System Security ...................................................................................................... 5

2.1 Identity and Access Management............................................................................. 5

2.2 Protocol and Session Security .................................................................................. 5

2.3 Preventing Cross-Site Scripting (XSS) Attacks ......................................................... 6

2.4 File Upload and Download Security .......................................................................... 6

2.5 Data Security............................................................................................................ 7

2.6 Database Connection Security ................................................................................. 7

2.7 Data Security through Redundancy and Versioning ................................................. 7

2.7.1 Canvas Disaster Recovery ...................................................................................... 7

3 Canvas Security Audits ........................................................................................................ 9

3.1 Internal Security Audits ............................................................................................ 9

3.2 External Security Audits ........................................................................................... 9

4 Instructure Internal Security ............................................................................................... 11

4.1 System and Data Access Policy ............................................................................. 11

4.1.1 Cryptographic Keys ................................................................................................11

4.1.2 Physical Security ....................................................................................................11

4.1.3 Secure Coding and Development Practices ...........................................................12

4.1.4 Testing and Quality Assurance ...............................................................................12

4.2 Instructure's Response to Security Alerts ............................................................... 12

5 Data Exposure Response Policy and Plan ......................................................................... 14

5.1 Data Exposure Response Policy ............................................................................ 14

5.2 Data Exposure Response Plan .............................................................................. 14

5.2.1 Determine the Scope of the Security Breach ..........................................................14

5.2.2 Assemble an Incident Response Team ..................................................................15

5.2.3 Control Dissemination of Information ......................................................................15



5.2.4 Alert Administrative Team ......................................................................................15

5.2.5 Identify Affected Persons .......................................................................................15

5.2.6 Notify Affected Persons ..........................................................................................15

5.2.7 Manage the Incident Resolution and Aftermath ......................................................15

6 FERPA Compliance ........................................................................................................... 16

6.1 FERPA Overview ................................................................................................... 16

6.2 Customization ........................................................................................................ 18

6.3 Permissions ........................................................................................................... 18

6.4 Course Settings ...................................................................................................... 19

6.5 Account Settings .................................................................................................... 21

6.5.1 Authentication Integration .......................................................................................21

6.5.2 Assessment Results in External Notifications .........................................................21

6.6 Other Default FERPA-related Features .................................................................. 22



1 CANVAS SECURITY INFRASTRUCTURE The Canvas education technology platform and learning management system is hosted on the state-of-the-technology cloud infrastructure provided by Amazon Web Services (AWS). The AWS infrastructure is highly stable, fault-tolerant, and secure as attested by the following certifications:

• Statement on Auditing Standards No. 70 (SAS 70) Type II audited

• Service Organization Controls 1 (SOC 1) reported and published under both the Statement on Standards for Attestation Engagements 16 (SSAE 16) and the International Standard on Assurance Engagements 3402 (ISAE 3402) standards

• Certified ISO/IEC 27001:2005 Information technology – Security techniques – Information security management systems – Requirements

• Level 1 service provider under the Payment Card Industry (PCI) Data Security Standard (DSS)

• Federal Information Security Management Act (FISMA) Moderate Authorization and Accreditation received from the U.S. General Services Administration.

For additional information about AWS security certifications and standards compliance, please refer to http://aws.amazon.com/security and http://aws.amazon.com/compliance/.

1.1 AWS Network Security

The AWS cloud infrastructure provides extensive network and security monitoring systems to protect the Canvas production environment and its data. These systems protect against:

• Distributed Denial Of Service (DDoS) Attacks. Proprietary DDoS mitigation techniques are used. Additionally, AWS’s networks are multi-homed across a number of providers to achieve Internet access diversity.

• Man In the Middle (MITM) Attacks. All of the AWS APIs are available via SSL-protected endpoints which provide server authentication. Amazon Elastic Compute Cloud (EC2) Amazon Machine Images (AMIs) automatically generate new Secure Shell (SSH) host certificates on first boot and log them to the instance’s console.

• IP Spoofing. Amazon EC2 instances cannot send spoofed network traffic. The AWS-controlled, host-based firewall infrastructure will not permit an instance to send traffic with a source IP or MAC address other than its own.

• Port Scanning. When port scanning is detected, it is stopped and blocked.

http://aws.amazon.com/security

http://aws.amazon.com/compliance/



1.2 AWS Services

The AWS services used to host Canvas include Elastic Compute Cloud (EC2), Elastic Load Balancing (ELB), Simple Storage System (S3), Elastic Block Store (EBS), Virtual Private Cloud (VPC), Simple Email Service (SES), CloudFront, Identity and Access Management (IAM), DirectConnect, and CloudSearch. All Canvas application nodes are hosted on the Amazon EC2 and S3 infrastructure, making full use of the real-time redundancy and capacity capabilities. Virtualization is provided by Amazon EC2.

1.3 AWS Regions and Data Centers

Amazon EC2 is hosted in multiple locations world-wide. These locations comprise regions and Availability Zones. Each region is a separate geographic area and each region has multiple, isolated locations known as Availability Zones. Instructure uses three AWS regions: the US East (Northern Virginia) Region with 5 EC2 Availability Zones, the US West (Oregon) Region with 3 EC2 Availability Zones, and the AWS EU West (Ireland) Region with 3 EC2 Availability Zones.

AWS data centers utilize state-of-the-art electronic surveillance and multi-factor access control systems. Data centers are staffed 24x7 by trained security guards and access is authorized strictly on a least privileged basis. Environmental systems are designed to minimize the impact of disruptions to operations. Multiple geographic regions and Availability Zones provide resilience in the face of most failure modes including natural disasters or system failures.

AWS data center electrical power systems are designed to be fully redundant and maintainable without impact to operations, 24 hours a day, and seven days a week. Uninterruptible Power Supply (UPS) units provide back-up power in the event of an electrical failure for critical and essential loads in the facility. Generators provide back-up power for the data centers of the entire facility.

1.4 AWS Data Security

All data traffic in and out of Canvas is at least 128-bit TLS/SSL-encrypted over HTTPS connections. Data is stored redundantly in the Amazon S3 infrastructure across and multiple geographic regions and multiple data centers. Canvas data is replicated in near real-time on the Amazon S3 infrastructure and is also backed up on a daily basis to geographically separate locations. Daily backups of Canvas data include media, file system data, course structures, coursework, analytics, rubrics, learning outcomes, and metadata. Canvas data replication and backups ensure that, in the event of a necessary system restore, the potential data loss would be limited to no more than ten minutes of data.



2 CANVAS SYSTEM SECURITY Canvas has been designed to achieve a high level of security by providing an uncomplicated, usable approach to user authentication, system access, and role-based, hierarchical permissions. Canvas is designed to support institution’s own internal security policies and to provide rigorous protection from internal or external intrusions. Canvas reinforces system security by presenting a simple security model to end-users because research shows that if users have to jump through too many security hoops, they will attempt to find ways to bypass security entirely.

2.1 Identity and Access Management


Canvas-internal authentication can be used alone or concurrently with any of the supported external IdPs identified above. For example, when used concurrently with LDAP, Canvas first presents user credentials to the external IdP. If authentication fails, Canvas then looks up the credentials using its internal authentication service. If authentication fails again, Canvas will deny the user login.

Canvas clients are encouraged to use Canvas in concert with their preferred external idP in order to best control and establish end-user security protocols. For Canvas-internal authentication, passwords must be 6 or more characters. Passwords are never stored in plain text. Passwords are securely hashed via the SHA-512 cryptographic hash algorithm with a randomly generated "salt" value. The resulting signature and salt value are then stored. When users attempt to authenticate, their credentials are passed through the same process and the resulting signature is checked against the stored signature. This process is exclusively uni-directional and passwords cannot be derived from their stored signature.

2.2 Protocol and Session Security

Canvas uses HTTPS (HTTP over TLS/SSL) for all communication. All inbound and outbound traffic is encrypted using 128-bit TLS/SSL ensuring that all personally-identifiable information, credentials exchange, page requests, and session data are secure.

Sessions are maintained and can be invalidated in the Canvas infrastructure. An encrypted session cookie, signed with a hash message authentication code (HMAC), is used only identify



a current session. The HMAC and cookie contents are encrypted with Advanced Encryption Standard (AES)-256 in cipher feedback (CFB) mode. The contents of the cookie cannot hijacked during transmission across the network, cannot be viewed or tampered with by the user, and cannot be accessed through javascript. Session IDs are compared and validated against the server-stored values. An invalidated session will require a user to login again.

Sessions are reset on each successful login to prevent access to session IDs by subsequent logins. To prevent cross-site request forgery (CSRF) vulnerabilities, all user actions that modify data require a session secret key to post data. All requests that modify data are done with HTTPS POST or PUT requests, never GETs.

2.3 Preventing Cross-Site Scripting (XSS) Attacks

Canvas employs a variety of strategies to prevent cross-site scripting (XSS) attacks. For example, when Canvas creates a form for user input, a one-time use token is embedded in the HTML form so that Canvas can identify the form and verify that it did not originate another site in a possible attack attempt.

As another example, because user-supplied JavaScript present a critical security vulnerability, Canvas does not allow non-administrative users to embed JavaScript directly into any Canvas pages. If, for example, a student were able to add JavaScript to a page, the student could embed code that changes the student’s grade when the instructor visits the page without the instructor detecting it. For this reason, only Canvas account administrators can add custom JavaScript.

Canvas sanitizes content to protect against intentional or unintentional vulnerabilities. When content is put into a Canvas form, such as content that a user enters with the Rich Content Editor, Canvas scrubs the content and removes any of malicious content. Content sanitization prevents session jacking, form hacks, and other unauthorized data access and/or modifications.

All user-inputted content is sanitized server-side—not in JavaScript which can be bypassed—before it is saved to the database. The sanitization is done by explicit whitelisting, not blacklisting. This prevents the addition of JavaScript to HTML data and prevent the addition of the unsafe HTML tags as well.

2.4 File Upload and Download Security

User-uploaded files are stored in the Amazon S3 infrastructure with unique names and folders. To prevent side-jacking from user uploaded files and preserve the integrity of the system, Canvas places uploaded files in the Files repository under a different subdomain to establish a separate security domain in order to take advantage of the browser’s same-origin security measures. The browser will enforce security between the uploaded files and the user’s session and prevent session jacking. If an uploaded file executes code using JavaScript, Java, Flash, or



other technologies, that code will not be able to access the user's session nor be able to make requests to Canvas on the user's behalf.

All file downloads require unique, short-lived authorization keys.

2.5 Data Security

Instructure has developed custom code to validate that all Canvas data models are protected against invalid assignment. For example, no user can change foreign keys arbitrarily and all lookups are scoped to the appropriate current user and context. All SQL is built using placeholders and a framework for escaping user input; strings are never directly interpolated or concatenated.

The Canvas API provides secure access to Canvas data and functionality while preventing direct access to Canvas databases. The Canvas API uses the industry-standard OAuth2 protocol which allows third-party applications to access data and perform actions on behalf of users without ever having possession of the user's password. Users that use the API can revoke access to specific applications at any time.

2.6 Database Connection Security

Application servers communicate with the database via a "bouncer," a database proxy that handles connection pooling. Connections between the application servers and the bouncer as well as between the bouncer and the databases are over a heavily firewalled virtual network. The protocol spoken is the PostgreSQL secure TCP/IP with TLS/SSL protocol.

2.7 Data Security through Redundancy and Versioning

To protect against malicious or accidental data destruction, Canvas stores data redundantly and employs soft-deletions. Administrators and instructors can recover previous versions of the gradebook, content pages, and assignment submissions.

Instructure maintains versions of all Canvas data and content by taking a series of periodic snapshots of databases. Snapshots of databases are taken daily and each daily snapshot is retained for a week. Weekly snapshots are taken and retained for a month. Monthly snapshots are taken and retained for a year.

2.7.1 Canvas Disaster Recovery

Most structured data—courses, user information, and assignments—is stored in a PostgreSQL database. This data is horizontally partitioned between instances based on account and demand. Each partition has a primary and a secondary or replica database, located in geographically separate sites. The data from each primary is replicated asynchronously in near-



real time to its corresponding secondary. Each primary is also backed up completely every 24 hours, and the backup is stored in a third geographically separate site.

Files for static assets from courses and assignments are stored on a scalable, protected, geographically redundant storage system of the Amazon S3 infrastructure. Multiple copies are stored by Instructure for backup.



3 CANVAS SECURITY AUDITS

3.1 Internal Security Audits

Instructure’s security team conducts quarterly internal security audits of the Canvas code base and Instructure’s production environment. Members of Instructure’s security team have many years of experience with security audits by major corporations and government agencies. Audit policies and procedures are reviewed on a regular basis and updated as needed by the security team.

The Instructure security team conducts thorough, comprehensive, prescriptive, internal security audits at least once a quarter. In these quarterly audits, the security team:

• Uses different development teams to do both Black Box and White Box testing.

o In Black Box testing, developers presume no prior knowledge of the code or the inner workings of the application and then attempt to discover and exploit security vulnerabilities by a variety of methods. Black Box testing requires developers to think like a hacker. "How would I break into this system? How would I steal this data?"

o In White Box testing, developers use their prior knowledge of the code and the inner workings of the application to test methods that could be exploited externally too. Developer reads through the application source code, looking for vulnerabilities at a low level.

• Attacks the application externally, using both off-the-shelf and custom internally-built tools.

• Documents potential vulnerabilities, recommends fixes, and implements the most advantageous fix. The fixes are then retested, by both the original discoverer(s) and other, new-to-the-problem team members.

• Pushes fixes made in external libraries to the upstream development activities to be immediately applied and included in official packages instead of waiting for the next scheduled Canvas update release.

Instructure encourages all clients to subscribe the Canvas Security Advisory Forum at http://help.instructure.com/forums/20382721-security-notices where security notices from internal security reviews, scanning, and testing are published.

3.2 External Security Audits

In addition to our frequent internal security audits conducted throughout the year, Instructure conducts annual, open, third-party security reviews. The 2012 review was conducted by the

http://help.instructure.com/forums/20382721-security-notices



security company, Securus Global, in December 2012 and the results are available at http://www.instructure.com/downloads/Instructure_Canvas_Security_Summary_2012.pdf.

The open, external security audit is one way that Instructure can demonstrate not only the state of Canvas security, but also our responsiveness to any vulnerabilities. For example, in that audit, Securus Global identified three high-risk vulnerabilities in Canvas itself and in the underlying libraries Canvas uses. Instructure fixed those vulnerabilities on the same day that Securus Global reported them and Instructure issued security bulletins to our customers. And because Canvas is a true multi-tenant application, Canvas clients never experience the adverse effects due to unapplied updates or patches due to version differences or added costs or wait times for service packs.

This same level of responsiveness is applied when Instructure receives external input on security outside of the formal audit process. For example, in January 2013, a Rails SQL security vulnerability was identified. Instructure patched this vulnerability within a couple of hours with no downtime. Instructure Engineering also provided the updates Canvas source code on Github at the same time. Additional details are available on the Instructure Security Advisory Forum at: http://help.instructure.com/entries/21563740-instructure-advisory-iac56413-rails-sql-injection-vulnerability.

In addition, because Canvas is open source, anyone may audit the Canvas code at anytime. Multiple institutions and other entities have conducted their own independent security audits of the code. If and when security defects or vulnerabilities are discovered, Instructure’s engineers work closely with these parties to resolve any discovered flaws. For customers who are interested in conducting their own security audit of Canvas, Instructure will, upon request, set up an environment, where they can conduct automated and manual vulnerability scanning.

http://www.instructure.com/downloads/Instructure_Canvas_Security_Summary_2012.pdf

http://help.instructure.com/entries/21563740-instructure-advisory-iac56413-rails-sql-injection-vulnerability

http://help.instructure.com/entries/21563740-instructure-advisory-iac56413-rails-sql-injection-vulnerability



4 INSTRUCTURE INTERNAL SECURITY Instructure uses commercially reasonable efforts to provide logical and physical security designed to maintain the integrity of the logical and physical security of its internal systems and customer data and content.

4.1 System and Data Access Policy

Instructure uses a multiple approval system for granting access to employees. First, the manager of the employee requesting access must fill out a ticket requesting detailed level of access to the system and specifying which parts, functions, and features are to be accessible by the employee. Clear, valid, and necessary business justification must be provided for the user in question.

The completed access request ticket is then routed to the Director of Operations. If approved by the Director of Operations, the request ticket is routed to the Operations team for final approval. If all parties approve the employee’s access, the Operations team grants access as requested in the ticket. Per the employee exit policy, user accounts are deleted upon termination of employment.

All on-boarded Instructure employees are required to read, understand, and sign Family Educational Rights and Privacy Act (FERPA) and Children's Online Privacy Protection Act (COPPA) compliance forms.

4.1.1 Cryptographic Keys

Instructure’s Operations team controls generation and installation of keys for all employees with access to the servers. An automated configuration system (Puppet) installs employee public keys on a per-server basis based on need. This same configuration process automatically revokes keys globally when necessary. Employees are required to use full-disk encryption and password protection on their work machines to protect their private keys and other sensitive data. The private keys used for HTTPS are stored encrypted and decrypted by operations when deployed to the application servers.

Monitoring and alerts are in place to detect and warn of any changes to keys, users on the system, login and sudo attempts, and other events of concern.

4.1.2 Physical Security

Access to Instructure’s offices is controlled using access cards. Instructure restricts access to internal servers by physical locks. Instructure uses commercially reasonable efforts to protect client data behind a secure firewall system, to conduct daily data backups, and to store weekly full-system backups in a separate, fire-resistant facility.



4.1.3 Secure Coding and Development Practices

Maintaining and enhancing security is a disciplined, continual, and ongoing process. Secure coding and security testing are, therefore, integral components of Instructure’s engineering and development methodology. All code in the application must go through a developer peer review process before it is merged into the code base repository. The code review includes security auditing are based on the Open Web Application Security Project (OWASP) secure coding and code review documents and other community sources on best security practices.

All Canvas developers are trained to identify and analyze security issues when writing and reviewing code. Members of the core security team and the engineering team subscribe to security-focused lists, blogs, and other resources to maintain, expand, and share the collective body of knowledge. Instructure maintains an internal wiki to discuss and share best practices for the mitigation and prevention of security pitfalls and vulnerabilities. The security and engineering teams keep up-to-date on general security practices, on recent attack vectors, and on any security issues specifically related to the languages, web applications, frameworks, and environments that Instructure employs to develop, host, and maintain Canvas.

Peer reviews of all source code changes are mandatory. Multiple peer reviews are conducted for each change to the Canvas code base to detect and correct any bugs, security flaws, and any other code defects. Changes to Canvas code must be validated by peer review before the code is approved and committed to the code base repository.

4.1.4 Testing and Quality Assurance

Once new code has passed peer review, the code is incorporated into the code base and submitted to testing and quality assurance. The new code is deployed to a continuous integration server where it is immediately tested. Instructure’s testing team runs:

• Unit tests (testing code with code)

• Integration tests (testing code with integrations with other code)

• Selenium tests (testing how code works in the browser) on all the different environments and across different databases.

After passing these tests, the code is incorporated in the main Canvas development code for formal quality assurance (QA). The QA team tests the new code on all supported platforms and browsers.

4.2 Instructure's Response to Security Alerts

Unlike traditional LMS licensed products with service packs which often do not address security problems for weeks or months and which must be applied by the users themselves, Canvas is a cloud service with a single version of the code base and production environment so that security



updates are immediately and automatically applied for the entire client base as part of Instructure’s hosting services.

Regular vulnerability scans of the Canvas application and infrastructure are conducted using third-party tools (for example, Burp Suite Pro), custom scripts, and open source tools. If any vulnerabilities are detected, Instructure’s security and engineering teams work together to analyze, design, and develop the required patch. Security-related patches to the operating system, application software, and libraries are applied within one (1) week except in those cases which have been determined to be high severity. If a high-severity security vulnerability is detected, fixing the vulnerability is given the highest priority by Instructure’s security and engineering teams. High-severity security patches will be applied within twenty-four (24) hours by best commercial efforts. In most cases, the vulnerability can be fixed using a hot patch without incurring any downtime to the Canvas production environment.

Instructure, in coordination with AWS, takes a proactive approach to enforcing SAS 70 Type II controls. Postmortems are convened after any significant operational issue, regardless of external impact, and Cause of Error (COE) documents are drafted so the root cause is captured and preventative actions are taken in the future. Implementation of the preventative measures is tracked during Instructure’s weekly operations meetings.



5 DATA EXPOSURE RESPONSE POLICY AND PLAN Data security and safeguarding users’ privacy are paramount concerns of Instructure. Instructure has implemented a comprehensive set of security technologies, management and review policies, monitoring operations, and enforcement procedures to ensure that our system and data security meets or exceeds governmental statutes and regulations, industry standards, and institutional requirements.

5.1 Data Exposure Response Policy

Backing up these preventative measures, Instructure has established a set of prescriptive responses to be executed in the event of unauthorized data exposure. Data exposure occurs when restricted or confidential information is disclosed, exposed, or reasonably believed to have been disclosed or exposed to an unauthorized person, process, or system.

Instructure’s data exposure policy has been designed to ensure:

• Earliest possible detection of a system or data security breach;

• Rapid securing of the system and data to prevent further unauthorized exposure;

• Responsive notification to users and other affected parties that confidential or personal information has been or may have been exposed or compromised by a breach in system security.

5.2 Data Exposure Response Plan

In the event of a breach of security and potential unauthorized data exposure, the information security officer will oversee and execute a plan of action that conforms to the guidelines described in the subsections below. The exact plan of action to be executed and the sequence of the actions taken will depend on the type and scope of the breach in security.

5.2.1 Determine the Scope of the Security Breach

In all cases, the information security officer and staff will quickly assess the status of the breach to determine whether the activity is ongoing. If the activity is ongoing, the security staff will take immediate requisite measures to stop the unauthorized activity in order to prevent any further data loss. Once the breach is isolated and stopped, the information security officer and staff will begin to ascertain the extent of the breach, the source and type of data involved, the amount of data, and the affected persons and system resources.



5.2.2 Assemble an Incident Response Team

The information security officer will assemble an incident response team. The composition and charge of the team will depend upon the type of breach and resulting data exposure. The team will conduct a preliminary assessment and risk assessment and help develop a tailored incident response plan. Once the incident is contained, this team will also evaluate changes in processes, systems and/or policies to prevent a repeat event.

5.2.3 Control Dissemination of Information

In order to ensure that only accurate, timely information that will not interfere with the ongoing investigation is released, only the information security officer will be authorized to provide information to any party outside of the incident response team.

5.2.4 Alert Administrative Team

The information security officer will alert the appropriate senior administrators including the Instructure executive team, client institution officials, system engineers, and other key players as warranted.

5.2.5 Identify Affected Persons

The information security officer will work with institution officials, Instructure’s VP of Engineering, Instructure’s Director of Operations, and the incident response team to determine the identities of affected individuals and determine the extent of the data exposure.

5.2.6 Notify Affected Persons

The information security officer will work with the VP of Engineering, Legal, Director of Operations, and the incident response team to draft and execute a notification plan. The purpose of the plan is to provide full, accurate, and timely notification that meets or exceeds all statutory requirements. In the case of high severity security issues, affected parties will be alerted immediately while indirectly affected parties will be alerted within twenty-four (24) hours. These legal requirements will vary on a state-by-state basis. Working with the appropriate parties, The information security officer and the incident response team notify all affected individuals and develop remediation strategies as appropriate and sufficient to the situation.

5.2.7 Manage the Incident Resolution and Aftermath

The information security officer and the incident response team will continue to update and communicate response status, determine next steps, and develop a postmortem plan to review the efficiency and effectiveness of the response and develop future prevention and/or mitigation processes and procedures.



6 FERPA COMPLIANCE Canvas was built to comply with the Family Educational Rights and Privacy Act (FERPA) by design and Canvas readily integrates with other campus systems to prevent unauthorized access to FERPA-protected data. Whether implemented as a standalone system or as a fully integrated component of the campus IT/IS infrastructure, Canvas provides educational institutions and agencies with multiple mechanisms and technologies to manage, enforce, and comply with the provisions of FERPA and to fulfill their responsibilities under its requirements.

6.1 FERPA Overview

FERPA is a Federal law that protects the privacy of student education records. The law applies to all schools and institutions that receive funds under the applicable program of the U.S. Department of Education. FERPA provides students, and in some instances parents, the right to inspect their education records and some ability to control the disclosure of information contained in their education records.1

FERPA requires educational agencies, which disclose personally identifiable information from a student’s education record to other school officials, to use “reasonable methods” to insure school officials obtain access to only the education records they have legitimate educational interests in.2

Table 6–1 identifies key sections and requirements of the Family Educational Rights and Privacy Act (FERPA) and briefly describes how Instructure and the Canvas learning management system (LMS) comply.

Table 6–1. Key FERPA Requirements and Instructure and Canvas Compliance

Item FERPA Section Requirements Comments

Instructure as a “School Official”

34 CFR§ 99.31 (1)(i)(B)

(1) Performs an institutional service or function for which the agency or institution would otherwise use employees; and(2) Under the direct control of the agency or institution with respect to the use and maintenance of education records; and(3) Is subject to the requirements of § 99.33(a) governing the use and redisclosure of personally identifiable information from education records.

Instructure is under the direct contractual control by the agency or institution with respect to the use and maintenance of education records.

1http://www2.ed.gov/policy/gen/guid/fpco/ferpa/index.html 2 34 CFR § 99.31




Agency or Institution Disclosure to Instructure as a “School Official”

34 CFR § 99.31 (a)(ii)

Education institution must use “reasonable methods” to make sure school officials have access to only education records they have legitimate educational interests in.

Provide Instructure only the information needed to serve its function. Access to educational records is dictated by course enrollment and role data provided by the institution. Access inside of a course can be further limited by groupings of students.

Requirement of Further Non-Disclosure

34 CFR § 99.33 (a)(1)

School can disclose information only on the condition that the party to whom the information is disclosed will not disclose the information to any other party without the prior consent of the parent or eligible student.

Contract with Instructure specifies that Instructure not disclose the information to any other party and otherwise in compliance with FERPA.

Permission settings within the Software

34 CFR § 99.30 (a)

Parent or eligible student shall provide a signed & dated written consent before an educational agency or institution discloses personally identifiable information from the student’s educational records, except as provided in § 99.31.

Agency or institution can change the permissions settings within the software to allow for, or deny, access to certain types of users.(See below page 6)

Course Settings Same as above Same as above Agency or institution can change the course settings within the software to allow certain users to access the course.(See below page 7-8)

Account Settings Same as above Same as above Agency or institution can change the account settings within the software to allow only certain users to access features. (See below page 9)

Names, not potentially sensitive contact information are displayed in Canvas(security feature)

Same as above Same as above Canvas displays students’ names in the course; however students’ email addresses or phone numbers will not be displayed. Students enrolled in the same course can contact one another, but the communication will be mediated through Canvas and students’ email addresses will not be disclosed.

Log off inactive users (security feature)

Same as above Same as above Canvas automatically logs out users after a period of inactivity.




Browser Session Logout(security feature)

Same as above Same as above Once a browser session is closed and a new browser is opened, Canvas will require the user to login again.

Authentication Integration

Same as above Same as above Single-sign-on is highly encouraged. All access to the system is dictated by the Institution-controlled identity system (SAML 2.0, CAS, LDAP, Shibboleth etc.).

6.2 Customization

Under FERPA, each school must define in their annual notification who constitutes a school official and what constitutes a legitimate educational interest.3 Because of this variation, Canvas provides settings that can be configured to conform to each school’s definitions. This document describes the various Canvas settings related to FERPA, the default settings, and the changes that may be made to these settings.

6.3 Permissions

One of the main FERPA-related tools available to educational agencies is the ability to define the permission settings for specific user roles in Canvas. Roles are established and communicated within Canvas by the type of course or section enrollment. The management of enrollments and the associated role permissions enable schools to specify what data each user can view. Both instructor and teacher’s assistant enrollments can be limited to student data in a section, which is a sub-group of the overall course enrollments. Enrollment data is typically furnished via integration with the institution’s student information system (SIS). The default permission settings can be changed to either allow or deny access to specific features and data.

To access the permission setting page in Canvas as shown in Figure 6–1, select “Permissions” from the dashboard’s left hand menu in a Canvas course. In addition to the user roles of Students, Teachers, and Course Designers, Canvas also has the predefined roles of:

• TAs – individuals who serve as a teacher’s assistants.

• Observers – individuals who have access to the course, but do not participate in the course.

3 34 CFR § 99.7



Figure 6–1. Specifying permission settings in Canvas by user group.

6.4 Course Settings

All data and course content is securely stored under an associated access control policy. Every time the data or content is accessed, this access control policy is consulted before access is granted to the requested resource. By default, Canvas only allows users enrolled in a course to view course content. With the growing need for OpenCourseWare and open educational resources, Canvas through the mechanism of these access control policies can safely permit the sharing of course content publicly while protecting and maintaining the privacy all personal and FERPA associated content. These policies support the sharing of continuously updated course content without compromising data security.

The procedures below step through the process for making a course public while keeping all the student data private and secure.

1. Click on “Courses” from the top-level navigation menu in the Canvas dashboard to display the course selection page. Select the course for which you would like to change the settings.

2. Select “Settings” from the left hand course menu to display the course details page as shown in Figure 6–2.

3. Click on the “Edit Course Details” button at the bottom of the course details page.



Figure 6–2. Course details page.

4. Select the box next to “Make this course publicly visible,” then click “Update Course Details” as shown in Figure 6–3.

Figure 6–3. Setting the course visibility to public.



6.5 Account Settings

6.5.1 Authentication Integration

Single Sign-On (SSO) is configured at the account level. SSO gives the institution full control over which users are authenticated and how that authentication is performed. Role information is communicated with enrollment data via integration with the institution’s SIS. Supported identity protocols include LDAP, Active Directory, CAS, SAML 2.0, and Shibboleth.

6.5.2 Assessment Results in External Notifications

An educational agency can decide whether or not it will allow students to have the ability to opt-in to receiving grades by external notifications through email, SMS, or other communication channels. By default, when an instructor assesses submitted assignments, students can receive notifications that they have received a grade on a specific assignment, but the notification will not include the grade received. If the educational agency has selected this option, it will allow the student to consent or opt-in to receive the grade in the notification as well.

To change the default setting:

1. Click on the “Settings” tab located on the left hand menu of the dashboard.

2. By default, the Settings tab will be displayed as shown in Figure 6–4.

3. Click on “Students can opt-in to receiving scores in email notifications” and then click “Update Settings.”

Figure 6–4. Allowing students to opt into receiving grades in notifications.



Figure 6–5. Students can opt into receiving grades notifications in their account settings.

6.6 Other Default FERPA-related Features

Additional features in Canvas related to FERPA compliance include:

• Inactive user logout. Canvas will automatically logout the user after a period of inactivity.

• Browser session logout. Once a browser session is closed and a new browser session is opened, Canvas will require the user to login again.

• Protection of sensitive contact information. Although Canvas displays students’ names, Canvas will not display students’ email addresses, phone numbers, and other sensitive contact information to other students. Canvas mediates communications, allowing users enrolled in the same course to contact one another without the disclosure of users’ actual contact information. Administrators with the appropriate permissions can access the audit and record of Canvas communications.



Appendix E. Catalog – Registration and Payment Portal

E.1 Features and Functions

Catalog incorporates and combines all of the fundamental features and functions of a well-designed website, course catalog, registration and enrollment processor, payment gateway, and certificate authoring engine to be an easy-to-use, out-of-the-box e-commerce solution. Some of the advanced LMS features and functions of Catalog include:

Attractive and Immediate Web Presence – With Catalog you have a modern website that is entirely custom-branded to match your organization’s brand and image (see Figure 1). Catalog client institutions enjoy offering their visitors and prospective learners the easiest user experience when searching, filtering, and selecting the courses that appeal to them.

Figure 60. Catalog’s Custom Branded Site



Unique Course Landing Page – Catalog puts the power of customizing each course offering in your hands (see Figure 2). For each course, you can create your own title, course description, upload custom images, and tweak the many details you want to communicate to prospective enrollees.

Figure 2. Catalog’s Unique Course Landing Page

Self-Service Registration and Payment – Perhaps the most powerful and time-saving of all Catalog’s features is its seamless integration with Canvas, allowing learners to visit the site, select courses they want to enroll in, create their own Canvas account, pay (if applicable), and begin learning – all without an action required from your administrators (see Figure 3).



Student Dashboard – Marketing courses effectively and converting website visitors to learners is only half the obstacle Catalog users face to run a successful initiative. Fostering an environment in which learners are engaged and organized is paramount to students completing courses and returning for new skills and knowledge. Catalog’s Student Dashboard is a clean, modern interface that each learner sees upon login (see Figure 4). The dashboard informs on which courses you are currently enrolled in, which courses you’ve signed up for that are starting soon, and which courses you’ve completed. You are also given a detailed summary about what each course is about, and how much progress you’ve made towards completion and earning the certificate. For ultimate clarity, each course listing has a link to resume the course exactly where the learner last left off.

Figure 4. Catalog’s Student Dashboard

Figure 3. Catalog’s Registration and Payment Capabilities



Course Bundling – Catalog also provides flexibility in offering courses as single learning experiences, as well as bundling a series of courses together and marketing them as one larger achievement. Whether you want to position a three or nine-course learning path as a certification, specialization, or program, Catalog provides the tools to make this clear to your visitors. The Student Dashboard also reflects a difference between completing single courses, and making progress towards a larger group of courses completed (see Figure 5).

Intuitive Catalog Authoring Tools – Catalog’s authoring tools live inside Canvas, so you don’t have to manage multiple accounts to administrate simply and successfully. Adding new courses to Catalog is as simple as typing in text entry boxes, while adding custom images is an easy point-and-click process. The authoring tools extend themselves to writing the entire course description, and even creating your own certificates to issue upon course completion (see Figures 6 & 7).

Figure 6. Catalog’s Intuitive Authoring Editor

Figure 5. Progress Towards Certification



Figure 7. Catalog’s Content and Image Editor



Appendix F. Signed Forms

The signed “Bid Form” is provided on the following page and the completed Insurance Certificate.

CERTIFICATE HOLDER

© 1988-2010 ACORD CORPORATION. All rights reserved.ACORD 25 (2010/05)

AUTHORIZED REPRESENTATIVE

CANCELLATION

DATE (MM/DD/YYYY)CERTIFICATE OF LIABILITY INSURANCE

LOCJECTPRO-

POLICY

GEN'L AGGREGATE LIMIT APPLIES PER:

OCCURCLAIMS-MADE

COMMERCIAL GENERAL LIABILITY

GENERAL LIABILITY

PREMISES (Ea occurrence) $DAMAGE TO RENTEDEACH OCCURRENCE $

MED EXP (Any one person) $

PERSONAL & ADV INJURY $

GENERAL AGGREGATE $

PRODUCTS - COMP/OP AGG $

$RETENTIONDED

CLAIMS-MADE

OCCUR

$

AGGREGATE $

EACH OCCURRENCE $UMBRELLA LIAB

EXCESS LIAB

DESCRIPTION OF OPERATIONS / LOCATIONS / VEHICLES (Attach ACORD 101, Additional Remarks Schedule, if more space is required)

INSRLTR TYPE OF INSURANCE POLICY NUMBER

POLICY EFF(MM/DD/YYYY)

POLICY EXP(MM/DD/YYYY) LIMITS

WC STATU-TORY LIMITS

OTH-ER

E.L. EACH ACCIDENT

E.L. DISEASE - EA EMPLOYEE

E.L. DISEASE - POLICY LIMIT

$

$

$

ANY PROPRIETOR/PARTNER/EXECUTIVE

If yes, describe underDESCRIPTION OF OPERATIONS below

(Mandatory in NH)OFFICER/MEMBER EXCLUDED?

WORKERS COMPENSATIONAND EMPLOYERS' LIABILITY Y / N

AUTOMOBILE LIABILITY

ANY AUTOALL OWNED SCHEDULED

HIRED AUTOSNON-OWNED

AUTOS AUTOS

AUTOS

COMBINED SINGLE LIMIT

BODILY INJURY (Per person)

BODILY INJURY (Per accident)PROPERTY DAMAGE $

$

$$

THIS IS TO CERTIFY THAT THE POLICIES OF INSURANCE LISTED BELOW HAVE BEEN ISSUED TO THE INSURED NAMED ABOVE FOR THE POLICY PERIODINDICATED. NOTWITHSTANDING ANY REQUIREMENT, TERM OR CONDITION OF ANY CONTRACT OR OTHER DOCUMENT WITH RESPECT TO WHICH THISCERTIFICATE MAY BE ISSUED OR MAY PERTAIN, THE INSURANCE AFFORDED BY THE POLICIES DESCRIBED HEREIN IS SUBJECT TO ALL THE TERMS,EXCLUSIONS AND CONDITIONS OF SUCH POLICIES. LIMITS SHOWN MAY HAVE BEEN REDUCED BY PAID CLAIMS.

INSRADDL

WVDSUBR

N / A

$

$

(Ea accident)

(Per accident)

THIS CERTIFICATE IS ISSUED AS A MATTER OF INFORMATION ONLY AND CONFERS NO RIGHTS UPON THE CERTIFICATE HOLDER. THISCERTIFICATE DOES NOT AFFIRMATIVELY OR NEGATIVELY AMEND, EXTEND OR ALTER THE COVERAGE AFFORDED BY THE POLICIESBELOW. THIS CERTIFICATE OF INSURANCE DOES NOT CONSTITUTE A CONTRACT BETWEEN THE ISSUING INSURER(S), AUTHORIZEDREPRESENTATIVE OR PRODUCER, AND THE CERTIFICATE HOLDER.IMPORTANT: If the certificate holder is an ADDITIONAL INSURED, the policy(ies) must be endorsed. If SUBROGATION IS WAIVED, subject tothe terms and conditions of the policy, certain policies may require an endorsement. A statement on this certificate does not confer rights to thecertificate holder in lieu of such endorsement(s).

The ACORD name and logo are registered marks of ACORD

COVERAGES CERTIFICATE NUMBER: REVISION NUMBER:

INSURED

PHONE(A/C, No, Ext):

PRODUCER

ADDRESS:E-MAIL

FAX(A/C, No):

CONTACTNAME:

NAIC #

INSURER A :

INSURER B :

INSURER C :

INSURER D :

INSURER E :

INSURER F :

INSURER(S) AFFORDING COVERAGE

SHOULD ANY OF THE ABOVE DESCRIBED POLICIES BE CANCELLED BEFORETHE EXPIRATION DATE THEREOF, NOTICE WILL BE DELIVERED INACCORDANCE WITH THE POLICY PROVISIONS.

INS025 (201005).01

9/4/2014

Diversified Insurance Group136 E. South Temple StreetSuite 2300Salt Lake City UT 84111

Deborah Walling(801)325-5000 (801)532-2804

[email protected]

Instructure, Inc.6330 South 3000 East, Ste. 700

Salt Lake City UT 84121

Atlantic Specialty Insurance 27154Lloyds of London 10736

14-15 Master Casualty

AX

X

X

711013122-0002 2/1/2014 4/1/2015

1,000,000500,00015,000

Excl; See E&O2,000,0002,000,000

A

X X

711013122-0002 2/1/2014 4/1/2015

Includes Hired Auto

Physical Damage

$50K Limit/ $500 Ded.

1,000,000

A

X X

711013122-0002 2/1/2014 4/1/2015

5,000,0005,000,000

A

N406038577-0002 2/1/2014 4/1/2015

X500,000500,000500,000

B Professional Errors & 470018 2/1/2014 4/1/2015 Limit/ Retention $5MM/$50KOmissions (Claims Made)

Evidence of insurance.

Regan Guth/DWALL

North Carolina Department of Public Instruction 6330 Mail Service Center Raleigh, NC 27699-6330