What an LMS Security Review Actually Asks: 30 Real CISO Questions & Our Answers
Preparing for an enterprise IT or CISO security review? Here are the 30 questions security teams ask most frequently, complete with verifiable architecture answers.
Personal Academy, Security
A department of the team that builds Personal Academy
LMS security reviews evaluate four critical domains: Identity & Authentication (SAML 2.0, MFA, SCIM), Data Protection (AES-256 at rest, TLS in transit, multi-tenant isolation), Governance & Audit (append-only audit logs, role-based access control), and Regulatory Compliance (GDPR, DPDP Act 2023, SOC 2). Personal Academy provides pre-filled compliance documentation for all 30 questions.
Core Findings & Takeaways
- Security reviews scrutinize multi-tenant isolation, data encryption, and identity federation before contract signing.
- PostgreSQL Row-Level Security (RLS) enforces database-level tenant isolation at the database query engine layer.
- All 30 standard CISO audit questions are documented and pre-filled in Personal Academy’s Trust Center.
Domain 1: Identity, Authentication & Provisioning
1. Does the platform support SAML 2.0 and OIDC federation? Yes. Personal Academy natively integrates with Okta, Microsoft Entra ID (Azure AD), Google Workspace, and PingIdentity.
2. Is SCIM 2.0 directory sync supported for automated deprovisioning? Yes. Employee deactivations in your IdP immediately revoke LMS access and terminate active sessions.
3. What password policies and MFA enforcement are available? When SSO is active, your IdP handles MFA policies. For local accounts, bcrypt hashing with salting and brute-force rate limiting are enforced.
Domain 2: Data Isolation & Encryption
4. How is multi-tenant data segregated? Personal Academy utilizes PostgreSQL Row-Level Security (RLS) with session-scoped tenant IDs (`app.current_tenant_id`). Every database query enforces tenant boundary isolation directly at the database engine level.
5. What encryption standards are applied? Data at rest is encrypted using AES-256. Data in transit is encrypted with TLS 1.2 or higher with HSTS headers enabled.
6. Where is customer data physically hosted? Production infrastructure runs in isolated AWS/Supabase enterprise data centers with automated encrypted daily backups.
Written by
Personal Academy, Security
Identity, data isolation, audit, privacy and compliance. Nothing is claimed that the code does not do today.
Related Analyses in Security
View all articles →The "SSO Tax": Why Some LMS Platforms Still Gate Security Behind Enterprise Plans
Single sign-on is a baseline security control, not an enterprise luxury. See which LMS platforms are quote-only for their whole plan (SSO terms included), and who publishes SSO as included by default.
What is SCIM 2.0 Directory Sync, and Why IT Demands It for LMS Deprovisioning
System for Cross-domain Identity Management (SCIM) automates user onboarding and deprovisioning. Here is why security teams consider it essential for LMS governance.
Database Tenant Isolation: PostgreSQL Row-Level Security vs Shared Database Risks
How does modern multi-tenancy protect your employee data? An architectural analysis of PostgreSQL Row-Level Security (RLS) vs application-level filters.