--- title: Security Best Practices for Your LMS description: It's crucial to protect your organization and your employees from potential online security breaches. Learn how to keep your LMS secure with these tips. image: https://www.reflectionsoftware.com/hubfs/Blog%20Images/Feature%20Images/LMS%20Security%20Blog.png --- # Security Best Practices for Your LMS Posted by Sam Fellerer - November 18, 2020 - [**](https://www.facebook.com/sharer/sharer.php?u=https://www.reflectionsoftware.com/blog/security-best-practices-for-your-lms) - [**](https://www.linkedin.com/shareArticle?mini=true&url=https://www.reflectionsoftware.com/blog/security-best-practices-for-your-lms&title=&summary=&source=) - [**](https://twitter.com/home?status=) - [**](https://plus.google.com/share?url=https://www.reflectionsoftware.com/blog/security-best-practices-for-your-lms) - [**](mailto:?&subject=https://www.reflectionsoftware.com/blog/security-best-practices-for-your-lms&body=https://www.reflectionsoftware.com/blog/security-best-practices-for-your-lms) ** ![header-picture](https://www.reflectionsoftware.com/hubfs/Blog%20Images/Feature%20Images/LMS%20Security%20Blog.png "header-picture") You may have seen news stories about high profile cyberattacks on companies and government organizations. As our world becomes more digital, and more training moves online, the possibility of being the victim of a cyberattack becomes more real. If you’re the administrator of a Learning Management System (LMS), and you haven’t thought much about security, now is an excellent time to start! This process doesn’t have to be scary or difficult, it’s all about being informed and knowing the steps you can take to keep your users and your organization safe. ### Why Does Security Matter for an LMS? Really any piece of software or system that contains user data should be protected from malicious attackers who might use that information to harm your users or your organization. Your LMS likely houses sensitive employee information and passwords, as well as training policies and intellectual property. A breach in your LMS could also lead to attacks on other company systems. Therefore, it's important keep your LMS secure. Let’s go through some of the steps you can take now! ### Be Aware of Your Legal Obligations The first thing you should consider is **if any regulations apply to your organization that govern how you should handle your users’ information**. The most commonly talked about standard is the *[General Data Privacy Regulation (GDPR)](https://gdpr-info.eu/)*, which is a European Union regulation. If you have any users in the European Union, then GDPR probably applies to you, and you’ll need to make sure you’re giving your users proper notice along with their consent to use their information. The other major regulation to be aware of is the *[California Consumer Privacy Act (CCPA)](https://oag.ca.gov/privacy/ccpa)*. Unlike the GDPR that applies even if you only have one user in the EU, the CCPA only applies if your organization meets certain criteria. If you’re a for profit organization and you have either $25 million in gross revenue per year OR have information about 50,000 California residents, then CCPA applies to you. Neither of these regulations have specific rules for security, but both require organizations to take “reasonable” steps to protect their users. Both also have requirements for handling information and require you to notify users if their information is compromised in an attack. This might just mean applying security updates in a timely manner, using encryption appropriately, and other simple measures. If the information you have is particularly sensitive, “reasonable” might mean getting your organization certified for meeting security regulations like the [ISO 27k](https://www.itgovernance.co.uk/blog/what-is-the-iso-27000-series-of-standards) series of standards. Failure to protect your users’ information, or failure to inform them, could result in large fines and other sanctions. So it's important to take the steps to protect their information now to prevent bigger issues in the future! But if you aren't sure where to start or if reading legalese makes your head spin, reach out to your legal team for help figuring out the best steps for your organization to take. ### Only Store and Collect Necessary Information Part of the process of running a secure LMS should **include taking the data you store and collect about users into thoughtful consideration**. If you’re importing data from a payroll or HR information system, it might be tempting to import everything you can “just in case” you need it. But this could be a *dangerous practice* if you’re not careful. When you import sensitive information from another system, you’ve just increased your attack surface, or the number of ways a hacker can acquire that piece of information. This doesn’t mean you shouldn’t store anything on the LMS. But before you choose to import or collect a piece of information, think **“will this information help me make a decision about training?”** If the answer is no, then you probably shouldn’t keep it on your LMS. Additionally, there are some types of information that should never live on your LMS if you can avoid it such as: - Social Security numbers and other financial information - Medical information - Status as a member of a protected group - Birthdate -- This one might seem less obvious, but what you probably really need is Age to assign appropriate learning. If you're looking for something to celebrate, celebrate loyalty instead and use hire date anniversary! ### Implement Security Best Practices Whatever LMS you use, it likely has a variety of security settings you should understand and utilize. Does your LMS give you controls over password requirements? Bump up the minimum length or complexity. Can you restrict access to the website to only company computers? If your employees don’t train from home, then turn that on. If you don’t understand the options available to you, consult with your LMS provider and your internal IT/security teams. Be especially careful about which employees you give administrator accounts. Adhere to the [Principle of Least Privilege](https://digitalguardian.com/blog/what-principle-least-privilege-polp-best-practice-information-security-and-compliance), and only give people the minimum permissions they need to do their job effectively. End users are almost always the weakest link in any security strategy. Try to make sure your strategy takes this into account. Automating security tasks (like auditing permissions and adjusting settings when certain permissions are no longer necessary) is a good way to take human error out of the equation. ### In Summary Check if any privacy laws apply to your organization, be mindful of what information you keep about your users, and follow security best practices. Reach out to your team for help and ask your LMS vendor about what additional security options they may have available. Think about the security of your LMS now, and start protecting your users today! Topics: [Learning Management System (LMS)](https://www.reflectionsoftware.com/blog/topic/learning-management-system-lms), [Service & Support](https://www.reflectionsoftware.com/blog/topic/service-support), [security](https://www.reflectionsoftware.com/blog/topic/security) --- ### Recent Posts #### [By Alicia Seguin - April 07, 2026 How to Set Up a Learning & Development Review Process in Four Steps](https://www.reflectionsoftware.com/blog/how-to-set-up-a-learning-development-review-process-in-four-steps) [![read more](https://www.reflectionsoftware.com/hubfs/IMG-TurboSodium/Sodium%20v2/blog/arrow-recent-blog-post.png "read more")](https://www.reflectionsoftware.com/blog/how-to-set-up-a-learning-development-review-process-in-four-steps) #### [By Liesl Christle - March 09, 2026 What L&D Can Learn From the Unique Challenges of Seasonal Hiring](https://www.reflectionsoftware.com/blog/what-ld-can-learn-from-the-unique-challenges-of-seasonal-hiring) [![read more](https://www.reflectionsoftware.com/hubfs/IMG-TurboSodium/Sodium%20v2/blog/arrow-recent-blog-post.png "read more")](https://www.reflectionsoftware.com/blog/what-ld-can-learn-from-the-unique-challenges-of-seasonal-hiring) #### [By Liesl Christle - November 10, 2025 How Communities of Practice Can Build (And Sustain) a Learning Culture](https://www.reflectionsoftware.com/blog/how-communities-of-practice-can-build-and-sustain-a-learning-culture) [![read more](https://www.reflectionsoftware.com/hubfs/IMG-TurboSodium/Sodium%20v2/blog/arrow-recent-blog-post.png "read more")](https://www.reflectionsoftware.com/blog/how-communities-of-practice-can-build-and-sustain-a-learning-culture) --- ### Our Reflections Stay up to date with the latest learning and development industry trends! ### Subscribe to Our Newsletter ### Recent Posts ### Posts by Topic - [eLearning (43)](https://www.reflectionsoftware.com/blog/topic/elearning) - [training and development (32)](https://www.reflectionsoftware.com/blog/topic/training-and-development) - [employee development (24)](https://www.reflectionsoftware.com/blog/topic/employee-development) - [Instructional Design (22)](https://www.reflectionsoftware.com/blog/topic/instructional-design) - [Learning Management System (LMS) (18)](https://www.reflectionsoftware.com/blog/topic/learning-management-system-lms) - [eLearning developer (14)](https://www.reflectionsoftware.com/blog/topic/elearning-developer) - [employee training (14)](https://www.reflectionsoftware.com/blog/topic/employee-training) - [Company Culture (13)](https://www.reflectionsoftware.com/blog/topic/company-culture) - [gamification (13)](https://www.reflectionsoftware.com/blog/topic/gamification) - [online training tips (13)](https://www.reflectionsoftware.com/blog/topic/online-training-tips) - [human resources (12)](https://www.reflectionsoftware.com/blog/topic/human-resources) - [training module (12)](https://www.reflectionsoftware.com/blog/topic/training-module) - [design online training (11)](https://www.reflectionsoftware.com/blog/topic/design-online-training) - [Service & Support (8)](https://www.reflectionsoftware.com/blog/topic/service-support) - [Media Services (7)](https://www.reflectionsoftware.com/blog/topic/media-services) - [Video Tips & Tricks (7)](https://www.reflectionsoftware.com/blog/topic/video-tips-tricks) - [leadership and development (7)](https://www.reflectionsoftware.com/blog/topic/leadership-and-development) - [RS News (6)](https://www.reflectionsoftware.com/blog/topic/rs-news) - [Storyline 360 (6)](https://www.reflectionsoftware.com/blog/topic/storyline-360) - [Client Partner (5)](https://www.reflectionsoftware.com/blog/topic/client-partner) - [Compliance Training (5)](https://www.reflectionsoftware.com/blog/topic/compliance-training) - [coaching (5)](https://www.reflectionsoftware.com/blog/topic/coaching) - [animation learning (4)](https://www.reflectionsoftware.com/blog/topic/animation-learning) - [corporate training trends (4)](https://www.reflectionsoftware.com/blog/topic/corporate-training-trends) - [microlearning (4)](https://www.reflectionsoftware.com/blog/topic/microlearning) - [talent management (4)](https://www.reflectionsoftware.com/blog/topic/talent-management) - [Client Spotlight (3)](https://www.reflectionsoftware.com/blog/topic/client-spotlight) - [Preventing Harassment (3)](https://www.reflectionsoftware.com/blog/topic/preventing-harassment) - [millennial training (3)](https://www.reflectionsoftware.com/blog/topic/millennial-training) - [on-the-job training (3)](https://www.reflectionsoftware.com/blog/topic/on-the-job-training) - [security (3)](https://www.reflectionsoftware.com/blog/topic/security) - [Instructor Led Training (2)](https://www.reflectionsoftware.com/blog/topic/instructor-led-training) - [Tradeshow (2)](https://www.reflectionsoftware.com/blog/topic/tradeshow) - [performance management (2)](https://www.reflectionsoftware.com/blog/topic/performance-management) - [Cognition Updates (1)](https://www.reflectionsoftware.com/blog/topic/cognition-updates) - [marketing (1)](https://www.reflectionsoftware.com/blog/topic/marketing) - [progressive development (1)](https://www.reflectionsoftware.com/blog/topic/progressive-development) - [project management (1)](https://www.reflectionsoftware.com/blog/topic/project-management) - [retail online training (1)](https://www.reflectionsoftware.com/blog/topic/retail-online-training) - [succession planning (1)](https://www.reflectionsoftware.com/blog/topic/succession-planning) [see all](https://www.reflectionsoftware.com/blog/security-best-practices-for-your-lms#) ### Blog Archive - [August 2019 (5)](https://www.reflectionsoftware.com/blog/archive/2019/08) - [October 2019 (5)](https://www.reflectionsoftware.com/blog/archive/2019/10) - [September 2020 (5)](https://www.reflectionsoftware.com/blog/archive/2020/09) - [September 2019 (4)](https://www.reflectionsoftware.com/blog/archive/2019/09) - [November 2019 (4)](https://www.reflectionsoftware.com/blog/archive/2019/11) [![Shifting Company Culture ](https://no-cache.hubspot.com/cta/default/462737/17e73cc0-8532-4460-8ff3-76dc347f68ee.png)](https://cta-redirect.hubspot.com/cta/redirect/462737/17e73cc0-8532-4460-8ff3-76dc347f68ee) - [**](https://www.facebook.com/pages/Reflection-Software/501192376627194) - [**](https://twitter.com/reflectionsoftw) - [**](https://linkedin.com/company/reflection-software) Stay in the know. Subscribe to our Blog! ### Let's Get in Touch! We’ve got the learning solutions. You’ve got the vision. Let’s talk about it! ### Call Us [630.270.1200](tel:6302701200) ### Email Us [info@reflectionsoftware.com](mailto:info@reflectionsoftware.com) ### Fresh from our Blog ### Get Updates from Us! [Reflection Software](https://www.reflectionsoftware.com) ©2026 [Privacy Policy](https://www.reflectionsoftware.com/privacy-policy)         [Security Policy & Information](https://www.reflectionsoftware.com/security-policy-information) **