Building standards - digital competency assessment system: options appraisal

3. Technical Requirements

3.1 Context

1. Throughout engagements with stakeholders, it was apparent that the expected approach for a Digital CAS would be a centrally hosted digital system available over the internet via a web browser. It is expected that users will access the Digital CAS via the LABSS website. From the Digital CAS, users are expected to be able to directly access learning objects within the current Virtual Learning Environment (VLE), which will provide virtual learning opportunities to local authority building standards staff. Building Standards Hub users would have administrator access to the Digital CAS in order to perform maintenance tasks, for example when CAS competencies need to be updated to align with updates to legislation.

2. Although they will maintain the same look and feel, and they may exchange information, the LABSS Website, Digital CAS and VLE are expected to be separately built and hosted components which do not depend on each other to function correctly. This means that, while the diagram above outlines the expected user journey, there is no single point of failure. For example, if the LABSS website were unavailable, users could still navigate directly to the Digital CAS and VLE if they knew the URL.

3. The current VLE vendor, Learning Pool, have confirmed that the VLE can support deep linking to individual learning objects. This means that the Digital CAS can provide direct links from competency items to learning objects, whether they are managed within the VLE or by external training providers.

3.2 Local Authority Requirements

1. Engagement showed that, on the basis that the Digital CAS would be a web application which required no action from local authority IT departments, there were not considerable constraints applied from a Local Authority level:

• All web traffic should be encrypted in transit, and use standard ports (e.g. 443)
• Compatibility should be maintained with common web browsers, without reliance on having the latest versions
• URLs for the Digital CAS (and any third party URLs referenced by it) should be provided to local authorities for whitelisting
• There is a preference for modern authentication methods, e.g. multi-factor authentication (MFA) and single sign-on (SSO) where possible
• A Data Protection Impact Assessment (DPIA) should be carried out, with personal data capture kept to a minimum, and data security and data retention to meet UK GDPR regulations.

3.3 Scottish Government Requirements

1. Engagements with Scottish Government (SG) representatives were more focused around non-functional requirements:

• Any custom development to be hosted by SG should be hosted on the Cloud First platform
• If the solution is to be hosted by a third party, a full security assessment must be carried out
• Any custom development should be done in alignment with the Digital Service Scotland Standard (DSSS)
• Multi-Factor Authentication (MFA) is preferred for user authentication. The Identity Provider (IdP) which would be used if the platform is hosted by SG is OKTA
• Where appropriate, existing platforms and solutions already in place within SG should be re-used.

3.4 VLE Requirements

1. Following engagement with the incumbent provider of the Virtual Learning Environment (VLE), it was identified that integration with the VLE would be best accomplished using the following features:

• Single Sign-on (SSO) is supported using the SAML 2.0 protocol
• Deep-linking to specific learning items is possible, to enable linking from specific competencies in the Digital CAS

2. As such, it would be advantageous for the Digital CAS to take advantage of these features.

3. In addition, the VLE can support the provision of course completion (per user) via CSV file export on a nightly basis but receiving these into the Digital CAS is not seen as a key constraint at this stage.