Canvas@Illinois, General LTI Integrations

Requirements
Vendor Risk Assessment Process
Accessibility Review Process
Current LTIs
Disallowed LTIs

Canvas General LTI Integration Requirements

Learning Tools Interoperability (LTI) is a specification for learning technology/event standards maintained by the IMS Global Learning Consortium, to seamlessly integrate an external (vended) learning application into their courses. This includes a standard protocol for establishing a trusted relationship between the tool provider and the Leaning Management System (LMS), allowing students and teachers to have a seamless, integrated experience when using the tool within the course environment. To facilitate this process Privacy/Security and Governance have been engaged to assist with review and rating of any integration to be used with any Learning Management System (such as Canvas@Illinois).

Why is this necessary now?

In the past, the university’s third-party solutions received a cursory review prior to deployment within an LMS. But over the past few years, the university has been operating under a State of Illinois audit finding that we have not been properly vetting third party service providers before allowing them access to restricted university data, such as student education records. For this reason all third-party contracts receive this newer, more extensive review.

The Process:

To get started with your own learning integration, please request a vendor risk assessment here:  https://go.illinois.edu/vendorrisk

In addition to a written statement of use, the following items may be required when requesting a vended learning integration:

• Contact(s) within the requesting department or unit

• Copy of contract or agreement between the integration provider and University representative

  • This can be an instructor, purchasing representative, or anyone with the authority to enact a contract with a content provider

  • Please include proof of payment if this is a paid service

  • Costs that may be required by the student or end user in order to access vended/integrated content

• Technical and support contact(s) for the integration provider

• Target service for installation (ex: Canvas)

• Installation/setup method/documentation

  • Including connection method (usually provided in the form of key/secret and connection URL)

• End-user support contact and documentation, including escalation path and self-help support documentation (to be added to this Knowledge Base)

• Accessibility statement or certification (ex:  WCAG 2.x, VPAT)

• Security statement or certification (ex:  SOC2)

  • Also, any University-specific user, program or course-specific information that will be shared with integration

  • Statement of vendor data stewardship, if available

• Signed FERPA addendum:  https://go.illinois.edu/ferpabuy

Following a successful risk review, the LTI is subject to an accessibility review. Accessibility resources:

IT Accessibility Policy

Campus Administrative Manual Policy

US Federal Section 508

State of IL IITAA Standards

Approval Process for Third-Party Learning Management System Integrations

As with all software used on campus, the campus accessibility policy (CAM HR-86) requires that all information and computing technology (ICT) utilized by the university be accessible to those with disabilities. The learning management systems (LMS) the university uses have been evaluated and found to offer an accessible platform from which to build online course content, so one may confidently build online content there. Unfortunately, the same cannot be said for any third-party application, or LTI (Learning Tool Interoperability) that is integrated into an LMS. LTIs have been found to frequently introduce access barriers for individuals with disabilities. Because of this, each LTI must be reviewed for accessibility prior to use.

LTI Approval Process

The following flow diagram illustrates where the accessibility review occurs in the overall Canvas@Illinois LTI approval process.

As the diagram above shows, the Canvas LTI workflow has four phases indicated by columns running left to right: Getting Started, Vendor Risk Review, Accessibility Review, and Approved Use.

Phase 1: Getting Started

In the Getting Started phase, the requestor first checks the list of approved LTIs which appears on the lower half of the General LTI Integrations page. If the LTI is not listed, the requester needs to complete the Vendor Risk Assessment Form.

Phase 2: Vendor Risk Assessment

In phase two, the vendor risk assessment form is reviewed. If the vendor risk assessment meets university requirements, the requestor needs to contact the Canvas Service Owner to start the accessibility review process, and the LTI is approved for further review and testing. If the vendor risk assessment does not meet university requirements, a risk acceptance process can be followed to pursue the use of non-compliant software. Please contact digitalrisk@illinois.edu  to initiate this follow-up review.

Phase 3: Accesibility Review

In the third phase of LTI approval, the requested LTI undergoes an accessibility review to determine if the LTI conforms with federal and state accessibility laws. If no accessibility issues are found, the requested LTI is approved and can be used. If accessibility issues are found, the requestor will be notified that an approved accessibility exception will be needed in order for the LTI to be used on campus. At this point, the requestor may pursue an accessibility exception request or find an alternative LTI that may be more accessible.

Phase 4: Exception and Approval

If the vendor can address the issues identified in the accessibility review, the requested LTI can be used after a second accessibility evaluation verifies the issues are resolved. If the accessibility issues cannot be resolved, an Exception Request Form must be submitted with an alternate access plan (see article: Information and Communications Technology (ICT), Alternate Access Plans) to the Technology Accessibility Review Committee (TARC) which reviews and approves digital accessibility exception requests for campus.

Important: to see (and use) the "Request an Exception" link, you must first log in to the Exceptions page with your NetID and AD password using the link at the bottom of the page. The Exceptions page also provides an Alternative Access Plan Template that must be submitted as part of the exception request.

To receive an exception approval, the following conditions must be met:

• • No product with greater accessibility is available. Section 508 of the Rehabilitation Act of 1973, as amended (29 USC § 794d), requires the university to procure the most accessible product if more than one is available that meets business needs and no fully accessible product is available.
    
    
  • An accessible alternative access plan (AAP) has been created that will provide a substantially equivalent and timely alternative way to access the information or experience that the inaccessible software does not allow. It is the application requestor's responsibility to devise and document the AAP. The TARC will work with the exception requestor(s) to ensure their AAP is sufficient to provide access and to determine how long the exception is needed.

Once the exception request and alternate access plan have been submitted, the TARC will review the exception request to determine if the LTI can be used. If the exception request is denied, there is a chance to appeal; however, appeal decisions are final. If the application is not granted an exception after an appeal, it may not be used for university business.

A significant, show stopping issue with any of these reviews may be cause to disallow the integration within the Canvas@Illinois environment.

How long can I expect this review to take?

Current LTI Availability

* ^{integration did not fully pass accessibility assessment and requires annual review by the TARC}

LTI and Integrations That Have Failed a Review

Note:  Any request that has failed review can be submitted for re-evaluation. The initial portion of this re-evaluation will be to engage with the vendor to determine the extent to which updates have been made (if any) based on a previous review.