Cybersecurity Criteria in Procurement Process for IHLs' Learning Management Systems

79 Mr Chua Kheng Wee Louis asked the Minister for Education (a) whether the Government is able to share the cybersecurity criteria adopted by IHLs during the procurement process for learning management systems (LMS) developed by third-party vendors; and (b) whether the Government will encourage the IHLs to reassess these criteria in light of the data breach of Instructure's Canvas LMS in April 2026.

Mr Desmond Lee: The Ministry of Education (MOE) issues guidelines on cybersecurity standards for institutes of higher learning's (IHL's) Information Technology systems, including Learning Management Systems (LMS), which IHLs are required to abide by. These include engaging only LMS vendors that hold industry recognised certifications, such as ISO27001 and ISO27018, for information security management and cloud service providers, and complying with data protection obligations under the Personal Data Protection Act 2012.

MOE will continue to review and update its cybersecurity guidance to IHLs regularly, in light of evolving cybersecurity threats and lessons learnt from incidents.