Editable SOW · ~60 minutes

Model scope of work for an enterprise LMS

A bilingual statement of work a procurement officer can adapt in an hour: volumes, lots, Arabic/RTL, residency, SSO, acceptance, and exit — not a feature brochure.

Ungated

Last reviewed 2026-08-20

Draft

An enterprise LMS scope of work (نطاق عمل نظام إدارة التعلم) names who must learn what, which lots you are buying (platform, authoring, custom content), hosting geography, Arabic operations, SCORM/xAPI tests, identity federation, UAT evidence, and handover. Innovito’s model SOW is editable in the browser and downloads as Markdown you can paste into a tender portal.

We do not invent certificate numbers, pentest CVEs, or named client references on a marketing URL. Where a dated PDF exists, it is listed as an evaluator file — still without a form. Where it does not, the status says so.

Hub
RFP booklet
01 SOW
02 Scorecard
03 Answers
04 Security
05 ACR
06 SCORM
07 Credentials
08 Vendors

Edit in the browser. Saved on this device only.

Organisation nameCountryLearner bandArabic / bilingual is MUSTData residency is MUST

23/23 Include in SOW

Export this pack · No gate. No nurture sequence. Downloads are generated in your browser.

01. Parties, lots & definitions

Name the procuring entity, the vendor, and which lots this SOW covers (LMS, authoring, custom content, libraries).

MUSTSplit lots explicitlyLot A — enterprise LMS/LXP (delivery, evidence, admin). Lot B — AI authoring (optional). Lot C — custom eLearning production (optional). Lot D — off-the-shelf libraries (optional). Do not bury content production inside a platform licence.
MUSTDefine learner, admin, completion, evidenceLearner = named person in scope. Active learner = launched a learning object in the period. Completion = rule set in UAT. Evidence = exportable completion, score, and certificate records an auditor can request.

02. Objectives, volumes & success evidence

Who must learn what, by when, and which report a CHRO or auditor will ask for.

MUSTNamed volumesState registered learner band, concurrent peak, number of administrators, number of catalogues, and expected SCORM packages in year one. Feature lists without volumes produce incomparable bids.
MUSTAuditor-ready evidenceSuccess includes export of completions, scores, and certificates for a named cohort within an agreed SLA — not a dashboard screenshot.

03. Functional scope (LMS / LXP)

Catalogue, assignment, learning paths, assessments, certificates, manager views, and optional LXP.

MUSTCore deliveryThe platform shall assign courses and programmes, track progress, issue bilingual certificates, and expose admin reports. Optional LXP, mentoring, and manager-experience modules are named add-ons — not assumed.
SHOULDMobile learner accessLearner flows shall be usable on current iOS/Android browsers. Offline or restricted-network behaviour is a separate deployment class (see hosting).

04. Arabic / bilingual operations

RTL UI, bilingual certificates, Arabic notifications, and Arabic SCORM — not a language toggle.

MUSTTrue RTLLearner and admin interfaces shall render Arabic RTL (mirroring, truncation, numerals, form labels). English-only audits are not acceptance evidence.
MUSTBilingual certificatesCertificates shall support Arabic and English names, programme titles, and dates as specified in UAT samples.

05. Content standards (SCORM / xAPI)

Declared versions, sample package test, score rollup.

MUSTDeclared versions + sample testVendor shall declare SCORM 1.2 and/or 2004 and xAPI support, and shall play a buyer-supplied Arabic sample package with suspend/resume and score rollup recorded in admin reports.

06. Identity, SSO & HRIS

SAML 2.0 / OIDC against the buyer IdP, with a pilot test.

MUSTFederation test in pilotSAML 2.0 and/or OpenID Connect against the buyer’s IdP (commonly Entra ID). JIT or SCIM expectations are stated. SSO failure is a go-live blocker.

07. Hosting, residency & environments

Primary region, logs, backups, subprocessors, prod / UAT / DR.

MUSTWritten residency matrixPrimary data region (including in-Kingdom when required), whether analytics/logs leave the region, backup/DR geography, and named sub-processor classes. A marketing “region name” is not a matrix.
SHOULDUAT separate from productionA UAT (or equivalent) environment shall exist for IdP, SCORM, and Arabic notification tests before production cutover.

08. Privacy (PDPL / GDPR / local)

Training records as personal data: DPA, retention, export/delete.

MUSTPersonal data mapMap identity, progress, assessments, certificates, and support tickets. Require processor terms, retention, export/delete workflows, and admin audit logs. “GDPR-aligned” is not a jurisdiction-specific answer.

09. Security evidence

Encryption, RBAC, logging, vulnerability process, independent testing cadence.

MUSTBaseline questionnaire mappingVendor maps answers to the buyer questionnaire: encryption in transit/at rest, admin RBAC, audit logs, vulnerability SLAs, incident notification, backup restore tests. Generic PDF dumps that ignore the questions are rejected.

10. Accessibility

WCAG-oriented UI, keyboard, captions, RTL verification.

SHOULDAccessibility as UAT criteriaKeyboard paths, focus states, contrast targets, and caption/transcript support where video is in scope. Treat as acceptance criteria, not a marketing badge.

11. Implementation, training & hypercare

Plan, UAT, admin training, hypercare window.

MUSTNamed plan with checkpointsDiscovery, configuration, IdP test, sample SCORM, Arabic notifications, UAT sign-off, production cutover, hypercare. Procurement and IT remain aligned at each gate.

12. SLA & Gulf support

Severity, GST/AST hours, Arabic L1, maintenance windows.

MUSTTimezone and languageSeverity definitions, response/restore targets in Gulf business hours, escalation contacts, and whether L1 is available in Arabic and English. Vanity 99.99% without method is rejected.

13. Acceptance / UAT

Buyer files, not vendor demo data.

MUSTUAT on buyer artefactsPlay the buyer’s SCORM, federate the buyer’s IdP, send an Arabic notification, export a completion file. Theatre demos on vendor tenants are not acceptance.

14. Buyer responsibilities

IdP admin, content owners, privacy counsel, named product owner.

MUSTNamed owner and delaysBuyer provides IdP metadata, residency decision, Arabic glossary, and UAT testers on the dates in the plan. Vendor delays caused by missing buyer inputs are excluded from SLA credits.

15. Out of scope

Say what you are not buying so change requests stay honest.

SHOULDTypical exclusionsUnless listed as a lot: cinematic custom courses, HRIS core HR, payroll, classroom facilities, devices, and unrelated ITSM. AI credit packs are add-ons.

16. Change control

Written change requests with impact on cost, residency, and timeline.

MUSTNo silent scope creepNew catalogues, extra environments, extra language packs, or extra integrations require a written change with commercial and residency impact.

17. Exit, ownership & handover

Who owns packages, completions, and how long export takes.

MUSTExport on contract endBuyer-owned SCORM/xAPI packages, user lists, completions, and certificates shall be exported in documented formats within an agreed number of days after termination.

18. Commercial methodology (non-price)

Drivers, not a lump sum. Actual prices stay in the commercial envelope.

MUSTQuote by driverLicence by learner band, hosting/residency class, implementation, support tier, and named add-ons as separate lines. This SOW does not publish Innovito list prices.

Educational and evidentiary material for procurement and IT evaluators. Adapt with your legal, privacy, and information-security counsel. Commercial terms, SLAs, and certificate serials are confirmed in the bid — not invented on this page. · Procurement officer drafting the technical envelope