Canvas Integrations of External Tools

The Canvas Learning Management System allows for the integration of other online learning platforms that comply with the Learning Tools Interoperability (LTI) standard. Canvas calls these integrated platforms external tools. This document details the process to request a new LTI integration and lists the external tools currently integrated with Canvas.

Requirements

Learning Tools Interoperability (LTI) is an industry standard maintained by 1EdTech (formerly the IMS Global Consortium). LTI facilitates the creation of a trusted relationship between Canvas and an external tool, resulting in the tight integration of the third-party platform with Canvas. Information is shared between Canvas and the external tool so seamlessly that, in many cases, the student or faculty member is unaware they are using both platforms together within the course environment.

In the past, the university’s third-party integrations received a cursory review prior to deployment in Canvas. Faculty were given great freedom in their use of the Canvas platform, including the ability to install their own LTI integrations in their courses. Today, the ever-present risk of cybersecurity attacks, rising number of educational tools, and increasing user expectations for a seamless and secure learning environment call upon us to upgrade our scrutiny of external tools. Therefore, the following requirements are enforced for LTI integrations:

• External tools must pass a vendor risk assessment prior to LTI integration with Canvas.
• New LTI integrations must comply with the LTI version 1.3 standard. Integrations requiring unrestricted access tokens or using previous, deprecated versions of the LTI standard are not allowed.
• Existing LTI integrations that use deprecated versions of the LTI standard may temporarily remain in use while IT works with the vendor to upgrade to LTI 1.3.
• External tools must pass a platform accessibility audit prior to LTI integration with Canvas.
• The ability of faculty to perform course-level LTI integrations on their own has been revoked. Course-level integrations can be performed by IT as long as all other requirements are met. (Please create a support case to request such an integration.)

Request a New Canvas Integration

Canvas Integration Request Form

Complete the Canvas integration request form to begin the approval process. Please do not sign any contracts or agreements with the vendor until the risk assessment and accessibility review have been completed.

Vendor Risk Assessment Process

To assess vendor risk, Information Technology will contact the vendor to obtain evidence of compliance with current information security standards. As a starting point, vendors typically provide either a completed Higher Education Community Vendor Assessment Toolkit (HECVAT) or documentation of a System of Organization Controls Trust Services Criteria (SOC2) compliance audit.

The HECVAT is a questionnaire framework specifically designed for higher education to measure vendor risk. The questionnaire confirms that information, data, and cybersecurity policies are in place to protect our sensitive institutional information and constituents' personally identifiable information (PII).

A SOC 2 audit produces a report on the controls used by the vendor relating to security, availability, processing integrity, confidentiality, or privacy. SOC 2 reports provide detailed information and assurance about the controls used when processing users’ data.

Depending on the information supplied by the vendor, Information Technology may approve the LTI integration, ask the vendor for clarification or additional information, or disapprove the LTI integration. If approved for integration, vendors will be scheduled for periodic risk reviews on an ongoing basis.

The speed with which vendors respond to information requests is the dominant factor in the time needed to approve an integration.

Accessibility Review Process

Information Technology will contact the vendor to obtain evidence of product accessibility. Vendors usually provide a Voluntary Product Accessibility Template (VPAT®), which is a document that explains how products such as software, hardware, electronic content, and support documentation conform to the Revised 508 Standards for IT accessibility.

Depending on the information supplied by the vendor, Information Technology may approve the LTI integration, ask the vendor for clarification or additional information, ask the vendor to remediate accessibility problems, or disapprove the LTI integration. If approved for integration, vendors will be scheduled for periodic accessibility on an ongoing basis.

Approved Integrations

The following external tools are available within Canvas:

Integrations Under Review

Disapproved Integrations