Before ordering a corporate LMS or employee portal, pin down five things rather than a feature list: where the system gets employees and the org structure from, how people sign in, what format the learning content will be in, which reports managers need, and where personal data is stored. Those answers decide whether an off-the-shelf platform, a customised one or a custom build fits. The contractor questions below help you compare proposals on substance rather than on a polished demo.
Contents
First decide what you are actually buying
An LMS (learning management system) assigns courses to employees, runs tests and shows who has completed what. An employee portal is broader: news, documents, a staff directory, requests, a knowledge base. Companies often want both, and that is the first fork in the road: look for one system that does everything, or connect several existing ones.
Subscription cloud LMS
- When it fits
- Standard training: courses, tests, reminders, reports; no strict requirements on where data is stored
- What to check before deciding
- Where the data physically lives, whether you can export content and completion history, whether it supports single sign-on with your directory
Open-source LMS with customisation
- When it fits
- You need your own assignment logic or integration with business systems, while the core LMS features fit
- What to check before deciding
- Who will update the platform and your changes when new versions ship, and how much change your logic requires
Custom build
- When it fits
- Training is part of a unique process: work clearance, certification with special rules, links to operational systems
- What to check before deciding
- Whether the budget covers ongoing support, who owns the code, whether you have people to evolve the system
Five questions that shape the architecture
Where employees and the org structure come from
The source may be an HR system, 1C, a user directory or a spreadsheet. What matters is which one is authoritative: when someone moves to another department, where does that change and how quickly must the LMS see it? Leavers deserve their own rule: access should close automatically, not when an administrator remembers.
How employees sign in
If you have a corporate directory, it is reasonable to require single sign-on (SSO) over a standard protocol. OpenID Connect is an identity layer on top of OAuth 2.0: the application verifies the user's identity based on authentication performed by an authorization server. Employee passwords then do not live in yet another system.
What format the content will be in
Courses are built inside the LMS, bought from external authors or produced in authoring tools. SCORM, xAPI and cmi5 exist for moving content between systems; the cmi5 specification describes itself as a “profile” of xAPI for content launched from an LMS and as a better alternative to AICC/SCORM. Find out which formats you need to import now and what you can export if you switch systems.
Which reports are needed, and for whom
A department head sees their own people, HR sees the whole company, an employee sees only themselves. Write this down as a role and permission matrix before development starts: a permissions bug in a corporate system means one employee can see another's assessment results.
Where personal data is stored
An LMS or portal stores names, job titles, contacts and assessment results — personal data. In Kazakhstan, the Law “On Personal Data and Its Protection” (Article 12, paragraph 2) requires it to be stored in a database located in the Republic of Kazakhstan. For a cloud product, raise this with the vendor and your lawyer before the pilot; other jurisdictions have their own rules.
These five answers largely determine which path from the table above fits. If employees sync from one system, sign-in goes through a corporate directory and the vendor can store the data, an off-the-shelf platform is usually enough. If two or more answers sound like “our case is special”, estimate the customisation early.
Risks that surface after launch
These risks rarely show up in a demo, because demos run on tidy test data under an administrator account. Check each one in advance.
- Vendor lock-in: courses and completion history sit in a closed format and cannot be moved without manual work when you switch systems.
- Access rights: a manager accidentally sees other departments, or an employee opens someone else's result by changing an ID in the URL. This is broken access control, ranked first in the OWASP Top 10:2025.
- Leavers: the account stays active because the HR sync only ever adds people.
- Peak load: mandatory testing is assigned to the whole company with one deadline, and everyone takes it on the last day. Size the load from how many employees will really be online at once, not from the total user count.
- Accessibility: WCAG 2.2 defines three conformance levels — A, AA and AAA. Put the required level in the contract, otherwise there is nothing to test against.
- Frontline staff without computers: if part of the workforce learns only on phones, the mobile flow must be the primary one, not an extra.
- An empty system: without people who create and update courses, an LMS becomes an archive. Decide who owns content before launch.
- History migration: past assessment results are needed for reporting, and moving them from the old system is a separate task with its own scope.
Questions for developers: a checklist for comparing proposals
Ask every contractor the same questions and compare the answers. A good answer need not be long — it is specific and admits limitations.
How do employees get into the system, and out of it?
- Good answer
- The data source, sync frequency and automatic deactivation on leaving are described
- Warning sign
- “An administrator will add them manually”
Which single sign-on protocol do you support?
- Good answer
- They name a standard (OpenID Connect or SAML) and ask which directory you use
- Warning sign
- Their own login and password, no alternatives
Which course formats can be imported and exported?
- Good answer
- Import and export formats are listed, including completion history
- Warning sign
- They only talk about import
How are roles designed, and who tests permissions?
- Good answer
- There is a role matrix and tests for access to other people's data
- Warning sign
- “Permissions are configured in the admin panel”, with no word on testing
Where will employee data be stored?
- Good answer
- They name the country and hosting provider and will put it in writing
- Warning sign
- An evasive answer or just “in the cloud”
What happens when every employee signs in at once?
- Good answer
- They ask for your peak scenario and propose a load check before launch
- Warning sign
- “It will handle any load”
Who updates the platform and customisations after release?
- Good answer
- The update process and what support covers are described
- Warning sign
- Support is not discussed before signing
Who owns the code, customisations and access?
- Good answer
- Rights and access are assigned to the client in the contract
- Warning sign
- Only the contractor has access to the server and repository
How will the work be accepted?
- Good answer
- Scenario-based acceptance criteria and a pilot in one department
- Warning sign
- Acceptance “when it goes live”
Estimating scope without invented numbers
There is no average price for a corporate LMS: two systems with the same label can differ in scope many times over. An honest estimate is built from the variables you have already collected by answering the questions above.
- Number of roles and visibility rules: employee, manager, HR, course author, administrator, external participants.
- Number of integrations: HR system, directory for single sign-on, email or messengers for reminders, business systems.
- Content formats and how much must be migrated from the old system, including completion history.
- Reports: standard exports or dedicated management reports with special logic.
- Data storage requirements and hosting location.
- Interface and content languages, the mobile flow, the accessibility level.
- Post-launch support: updates, changes, who administers the system.
Inventory
Collect the answers to the five questions and the list of variables in one document.
Compare paths
For each of the three paths, mark which requirements it covers without customisation and which it does not.
Pilot
Run the chosen solution in one department with real employees and one mandatory course.
Acceptance criteria
Check sync, sign-in, permissions, reports and leaver deactivation on the pilot, not on demo data.
Roll-out
Bring in the remaining departments once the pilot has met the criteria.
The cost is determined after a brief and an agreed scope — with us and with any conscientious contractor. If someone quotes an exact price before discussing your org structure, permissions and data, it is the price of the system the contractor imagined, not yours.
Limitations and next step
This article is not legal advice: personal data requirements depend on what data you collect and who processes it, so the wording of the vendor contract should be agreed with a lawyer. Specific platforms change from version to version — check them against the vendor's current documentation rather than reviews.
If you want an independent view of the options or of a system that is already built, the formats below fit. A consultation gives you options, trade-offs and next steps; a written summary can be agreed as part of the format.
Sources
- Law of the Republic of Kazakhstan “On Personal Data and Its Protection” No. 94-V (Adilet, in Russian)
- OpenID Connect Core 1.0
- cmi5 Specification (AICC / ADL)
- W3C — Web Content Accessibility Guidelines (WCAG) 2.2
- OWASP Application Security Verification Standard
- OWASP Top 10:2025 — A01 Broken Access Control
