Self-hosted LMS for government agencies: FedRAMP and the other route

A government agency does not always need a FedRAMP certified LMS. FedRAMP covers cloud services that a provider runs and offers to agencies. If your agency installs an LMS on infrastructure it controls, then configures, operates and supports it, the software is outside FedRAMP scope. Your own security authorization (an ATO under the NIST Risk Management Framework) covers it instead.

So there are two legitimate routes: buy a SaaS LMS that holds FedRAMP certification, or run a self-hosted LMS for government use and carry the authorization work yourself. Most buying guides only describe the first. This one covers both, plus the mandatory training either system has to track.

One disclosure up front: LMS Advisor is not FedRAMP certified and holds no security certifications or attestations. It is built for the self-hosted route: you install it on an agency server or VM, connect SAML SSO and SCIM to your identity provider, and keep training records, audit logs and retention rules inside your own boundary. We say where it does not fit, too.

What does FedRAMP cover, and what does it leave out?

FedRAMP is the federal program that assesses cloud services before agencies use them. OMB memo M-24-15 sets its scope as cloud products and services (IaaS, PaaS and SaaS) that create, collect, process, store or maintain federal information on behalf of an agency, as the FedRAMP help center answer on private cloud deployments explains.

The FedRAMP scope page for the 2026 rules is specific about what falls outside. Two exclusions matter for an LMS:

• "Virtual on-prem" solutions deployed on agency-managed cloud infrastructure, then configured, operated and supported by the agency.
• Independent software vendor (ISV) applications distributed for installation in a single tenant. In FedRAMP's words, the host service is in scope, but the independent software is not.

Run an LMS on an agency server, or in your own tenant on a FedRAMP certified IaaS, and FedRAMP applies to the infrastructure provider, not the LMS. The LMS still needs security review, through your agency's own process.

What changed in FedRAMP in 2026?

If your team last looked at FedRAMP a year ago, the vocabulary has moved. Under the FedRAMP Consolidated Rules for 2026, "FedRAMP authorization" became "FedRAMP certification", and the Low, Moderate and High impact levels gave way to Certification Classes A through D. The dates to put on your calendar:

• July 4, 2026: the rules took effect.
• January 1, 2027: most Rev5 changes become mandatory and enforcement begins.
• June 11, 2027: no new Rev5 certifications.
• December 31, 2028: existing Rev5 certifications expire.

FedRAMP 20x is the replacement path. FedRAMP has said it will allow grace periods, so check the current page before you plan around a date.

The rename exists to fix a real misunderstanding. FedRAMP's Nicole Thompson told Federal News Network that many people assumed a FedRAMP authorization meant a provider was authorized across the whole federal government. It never did. Each agency still issues its own authority to operate.

The classes also do not replace your own system categorization. FedRAMP's guidance on Certification Classes says to categorize your information system first (Low, Moderate or High under FIPS 199), then review the provider's package. Class C, for example, is described as adequate for most Low or Moderate impact systems. An LMS holding names, work emails, org structure and training records for a federal workforce is often categorized Moderate, but that is your ISSO's call, not the vendor's.

Route 1: buy a FedRAMP certified SaaS LMS

This is the default answer, and for many agencies it is the right one. The provider runs the platform, a third-party assessor has tested it, and your agency reuses that package for its own ATO instead of starting from zero.

How do you verify a vendor's FedRAMP status?

Check the FedRAMP Marketplace, which the official FedRAMP site describes as the searchable database of certified cloud services, authorizing agencies and recognized assessors. Do it on the day you make a decision, not from a slide deck. Things to confirm on the listing:

1. The exact service offering name. Vendors often run a commercial platform and a separate government offering, and only one may be listed.
2. The status. The Marketplace separates certified offerings from those that are "In Process" or "Ready". Ready is a readiness assessment, not permission to use the service.
3. The class or legacy impact level, compared against your own system categorization.
4. Whether the features you are buying (proctoring, AI tools, video hosting, content libraries) sit inside the assessed boundary or depend on outside services.

Training platforms are on the list. When we searched GSA's public Marketplace data export in September 2026 (the file was last updated May 19, 2026), several learning platforms appeared, most at the Moderate level and still carrying the pre-2026 "Authorized" labels. We are not naming them here because statuses change. Search the live Marketplace yourself.

What are the trade-offs of the SaaS route?

• Less work, not zero. You still review the package, configure the tenant and run continuous monitoring on your side.
• Fewer choices. The certified field is a small slice of the LMS market, and the government offering sometimes lags the commercial product on features.
• Data location and exit. Your records live in the provider's environment. Ask how you get a full export of completions and certificates if you leave.

Route 2: a self-hosted LMS for government, on infrastructure you control

The other route is to install the LMS yourself: on a server in your data center, on a VM in your agency's cloud tenant, or with a contractor operating it for you under your control. FedRAMP does not certify the LMS in this case. Your agency authorizes the whole system under the NIST Risk Management Framework (SP 800-37 Rev. 2): categorize, select and implement controls, assess them, authorize, then monitor.

Teams pick this route for a few recurring reasons:

• The agency already runs a hardened hosting platform with an existing ATO, and adding an application to it is familiar work.
• No FedRAMP certified LMS covers a need the program has, such as proctored certification exams or a specific integration.
• Data has to stay on a particular network, including enclaves with no route to the public internet.
• The agency wants to own the database outright at contract end.

Ownership is real, and so is the maintenance that comes with it. Our comparison of self-hosted and cloud LMS options covers the general trade-off. The next section is the government-specific version.

What does self-hosting shift onto your team?

Everything a SaaS provider's assessor would have tested becomes your control implementation. In practice that means the following, and it helps to name an owner for each line before you commit.

Area	What your team does	Where it usually goes wrong
Security documentation	Write or extend the system security plan, boundary diagram and data flows for the LMS	Outbound integrations (email, SSO, video, AI) left off the diagram
Hardening	Apply your baseline to the OS, web server, PHP runtime and database	Test servers built once, never brought up to baseline
Patching	Patch the OS and runtime on your schedule, apply LMS releases and run their database migrations	Application updates skipped because nobody owns them
Backups and recovery	Back up the database and uploaded files, test a restore, cover it in the contingency plan	Database backed up, course media and certificate files not
Logging and monitoring	Send application audit logs and server logs to your SIEM	Audit logs kept only inside the app, where nobody reviews them
Identity	Connect SAML SSO to the agency identity provider, provision accounts with SCIM	Local passwords left enabled for convenience after go-live
Accessibility	Test the learner interface against Section 508	Assuming the vendor did it

Two points catch agencies out more than the rest.

Third-party calls from inside the app. Video conferencing, AI drafting, AI tutors, transcription and code execution for technical exams all send data somewhere. When you self-host, each call crosses your boundary and needs to be approved, contained or switched off. In LMS Advisor, the AI features use Anthropic or OpenAI (the admin picks) and can be turned off entirely. Proctoring audio clips go to OpenAI Whisper for transcription, and coding questions can run on a self-hosted Judge0 or Piston instance. Map these before your assessor asks.

Staffing after year one. The launch gets people and budget. Continuous monitoring and patching often get neither. If your hosting team cannot absorb another application, Route 1 is safer even if it costs more on paper.

What should a self-hostable LMS give you?

If you go this way, check for:

• A stack your hosting team already runs. LMS Advisor is plain PHP and MySQL and runs on an ordinary VPS or agency server.
• Built-in upgrade, backup and system-health tools, so an application update is not a custom project each time. LMS Advisor ships in-app migrations, backups and system-health checks for self-hosted installs.
• SAML 2.0 SSO and SCIM 2.0 provisioning against your identity provider, plus two-factor authentication and passkeys for any accounts outside SSO.
• Application audit logs and data retention settings you control.
• Delegated administration that matches your structure. Our branch, organization and role model lets a bureau or regional office manage its own people without seeing another office's records.

The security and data ownership page lists the identity and hosting controls in detail. What we cannot give you: a FedRAMP certification, a SOC 2 report, or a Section 508 conformance claim. Your team would do that testing and documentation as part of your own ATO.

Which mandatory federal training does an LMS have to track?

Whichever route you pick, the system has to handle federal recurrence rules. OPM's list of federally mandated training is the reference. The cycles are not all annual, which is where simple LMS setups break.

Training	Who	When	Authority
IT security awareness	All federal employees	Annually	5 CFR 930.301
Constitution Day education	All federal employees	At entry, and each September 17	Pub. L. 108-447
No FEAR Act	All employees, including supervisors and managers	At least every 2 years, and new employees within 90 days if not covered in orientation	5 CFR 724.203
Ethics	Covered employees (for example, certain appointees and contracting officers)	Annually	5 CFR 2638.705
Insider threat awareness	Employees with access to classified information	Within 30 days of employment or of being granted access	E.O. 13587
Telework	Eligible employees and managers approved for telework	Before signing a telework agreement	Telework Enhancement Act of 2010

The No FEAR rule in 5 CFR 724.203 also requires the agency's written training plan to describe how completion is documented. That is an LMS requirement hiding in a regulation. Keep the person, course version, completion date and next due date retrievable on request.

How to configure the LMS for these cycles

1. Build one course per requirement, not one "annual mandatory training" bundle. A 2-year No FEAR cycle and a 1-year security cycle will drift apart the first time someone completes late.
2. Use certificate validity to drive recurrence. In LMS Advisor, a course certificate can carry a validity period in months (12 for security awareness, 24 for No FEAR). It moves to an expiring-soon status 30 days before it lapses, and the learner renews by retaking the course.
3. Assign by organization with a due date and a mandatory flag, then work the overdue report weekly instead of the week before a data call.
4. Scope role-based courses (ethics, insider threat, purchase card) to groups fed from HR attributes through SCIM, so the right people get them without manual lists.

The certificates and compliance page shows how validity, renewal and audit logs fit together. Contractors supporting defense programs have a parallel set of rules, covered in our guide to CMMC awareness training requirements.

How are state and local agencies different?

FedRAMP is a federal program. States and localities have their own rules, but the questions are the same: is this a cloud service, which state program applies, and what training must we track?

Texas is a useful example because it has answers to both halves. On training, Texas Government Code 2054.5191 requires state and local government employees and officials to complete a certified cybersecurity training program. According to Texas DIR's statewide cybersecurity awareness training page, that applies to state employees who use a computer for at least 25 percent of their duties, to elected and appointed officers, and to local government employees who meet the same test and have access to a local government system. Entities certify compliance to DIR by August 31 each year. They can track completion in any method they choose and do not send training records to DIR.

On hosting, Texas runs TX-RAMP for cloud services bought by state agencies, universities and public community colleges. The TX-RAMP eligibility page states that products or services that are not cloud computing services are not subject to TX-RAMP, and it accepts FedRAMP Moderate evidence toward its Level 2 certification. The same two-route logic applies: a cloud LMS goes through TX-RAMP, and a system the agency runs itself goes through the agency's own security review. Confirm how your information security officer reads it for your deployment.

Other states run their own programs. Ask your state CIO's office which applies before you write the RFP. Our list of LMS RFP questions has a hosting and security section you can adapt.

A decision table for agency IT and L&D

If this is true for your agency	Lean toward
You need to launch this fiscal year and have no hosting team to spare	FedRAMP certified SaaS
A certified LMS on the Marketplace covers your required features and its class fits your categorization	FedRAMP certified SaaS
You already run a hosting platform with an ATO and a team that patches it	Self-hosted
Data must stay on an agency network or an isolated enclave	Self-hosted
You need features (proctored exams, specific integrations) no certified option offers	Self-hosted, or a certified LMS plus a separately authorized tool
You are a state or local agency outside FedRAMP scope	Either, following your state's cloud program

If your situation points to self-hosting, the next section shows how that route runs with LMS Advisor.

How to self-host LMS Advisor for agency training

For agencies on Route 2, here is how LMS Advisor maps to the work above. It does not change who carries the ATO. Your agency does, and LMS Advisor holds no FedRAMP certification or other attestation to lean on.

Task	In LMS Advisor
Hosting and patching	Install on an agency server or a VM in your tenant. It's plain PHP and MySQL, and in-app migrations, backups and system-health tools cover application updates.
Boundary and outbound calls	Switch AI features off entirely, or pick Anthropic or OpenAI. Run coding questions on a self-hosted Judge0 or Piston instance.
Identity	SAML 2.0 SSO and SCIM 2.0 provisioning against the agency identity provider, with two-factor authentication and passkeys for accounts outside SSO.
Delegated administration	Branches, organizations, groups and roles, so a bureau or regional office manages its own people.
Mandatory training cycles	Organization assignments with due dates and mandatory flags, overdue reports, and course certificates with a validity period in months, a 30-day expiring-soon status and an email rule for expiring certificates.
Role qualification exams	The Test Center runs exams with native proctoring set per exam and keeps an evidence trail for reviews and disputes.
Records and data calls	Audit logs, data retention settings, CSV, Excel or PDF exports, and webhooks or the REST API to feed completions into other systems.

What it won't do: provide a FedRAMP certification, a SOC 2 report or a Section 508 conformance claim, or supply an off-the-shelf course library. Bring existing courses as SCORM packages or build them in the authoring tools. See how LMS Advisor handles government training programs, then request a demo with your hosting and security questions in hand. We will tell you plainly where your team would carry the work.

Frequently asked questions

Which LMS is best for a government agency that wants to self-host?

For the self-hosted route, we put LMS Advisor first: it runs on your own server on a plain PHP and MySQL stack, with SAML SSO, SCIM, audit logs, certificate validity for recurring training and proctored exams built in. It holds no FedRAMP certification, so your agency authorizes it through its own ATO process. If you need a FedRAMP certified SaaS instead, search the FedRAMP Marketplace.

Does a government LMS need to be FedRAMP certified?

Only if it is a cloud service a provider runs for a federal agency. An LMS the agency installs and operates on infrastructure it controls is outside FedRAMP scope, though the agency must still authorize it under its own ATO process.

Can a state agency self-host an LMS instead of using a certified SaaS?

Usually yes, subject to state policy. Texas, for example, applies TX-RAMP to cloud computing services and says services that are not cloud computing are not subject to it. Check with your state CIO or information security office, because each state writes its own rules.

What FedRAMP impact level does an LMS need?

That depends on your agency's FIPS 199 categorization of the system, not on the product category. Many LMS deployments holding workforce records are categorized Moderate. Under the 2026 rules, compare your categorization to the provider's Certification Class and review its package.

How do I verify a vendor's FedRAMP status?

Search the FedRAMP Marketplace for the exact service offering name. Confirm whether it is certified, In Process or Ready, and check its class or impact level. Do not rely on a vendor's website, sales deck or press release, because statuses change.

Is LMS Advisor FedRAMP certified?

No. LMS Advisor holds no FedRAMP certification and no other security certification or attestation. An agency that uses it runs it on its own servers and authorizes it through its own process.