User roles and permissions
Public documented controlEvidence available
The onCourse handbook documents individual users, roles and permissions.
Supporting detailWhat to review
Map access to responsibilities and test least-privilege settings.
Assurance and evidence
Get the detail your team needs to assess onCourse.
Your team needs a clear basis for deciding whether onCourse fits your organisation. Start with the public controls and evidence below. Then review the service boundaries, responsibilities and evidence needed for the way you intend to use the platform.
Start with the controls already documented.
The handbook explains individual user accounts, roles, permissions, login protections and audit activity. Use those references to identify what your team needs to see, then test the relevant settings and responsibilities against your proposed use.
Login protections
Public documented controlEvidence available
The handbook documents security settings and two-factor authentication for onCourse logins.
Supporting detailWhat to review
Confirm the login and identity design for the proposed users, including any separately scoped SSO.
Audit activity
Public documented controlEvidence available
The handbook documents audit logging for reviewing who changed a record and when.
Supporting detailWhat to review
Confirm relevant events, retention, access and investigation needs.
Review the service your organisation would use.
Payment handling, data location, recovery and service commitments need to be considered in context. We will work through the applicable service, connected systems and responsibilities with you, and confirm the evidence available for that arrangement.
Payment assurance
Published evidenceEvidence available
ISH publishes a payment-security attestation for review. Its applicability depends on the payment flow and service boundary.
Supporting detailWhat to review
Review the published attestation against the providers, responsibilities and payment flow in your proposed arrangement.
Hosting and Australian data storage
Discuss for the proposed serviceEvidence available
ISH describes onCourse as operated on AWS with Australian data storage for the managed service context described on this site.
Supporting detailWhat to review
Confirm the location of data, backups and copies held by subprocessors or connected systems, alongside data categories and flows.
Recovery and service commitments
Discuss for the proposed serviceEvidence available
Review the recovery approach and service commitments for your proposed arrangement.
What to review
Request the applicable recovery approach, service commitments, escalation path and evidence.
Accessibility
Discuss for the proposed serviceEvidence available
Accessibility requirements need validation against the intended use.
What to review
Agree the applicable standards, test scenarios, responsibilities and acceptance evidence.
Shared institutional services
Discuss for the proposed serviceEvidence available
Cross-institution identity, coordinated discovery and consolidated reporting require separate assessment.
What to review
Agree architecture, responsibilities, privacy, data boundaries and acceptance evidence before a delivery commitment.
Bring your review questions into one place.
Tell us the requirements your security, privacy, accessibility, operations and procurement colleagues need to assess. We can identify the information already available, the points needing confirmation and any work that requires a separate scope or test.
Discuss your assurance requirements