Industry Advantage IT Security FAQs & Architecture

LIMRA and LOMA’s Industry Advantage program leverages Rustici Software’s Content Controller to host, control access to, and distribute course files. We are committed to IT security and privacy. Accordingly, we’ve fully vetted the security and privacy of Content Controller according to our own IT procurement policies and have assembled FAQs and resources for your own IT department to review.

How does Content Controller work?
LIMRA and LOMA load our Industry Advantage course files into a hosted instance of Content Controller, and then export and send proxy course packages to Members in their preferred eLearning standard. Members load the proxy packages into their own LMS as if they were SCORM, AICC, or cmi5 courses. When a learner launches an Industry Advantage course from the Member’s LMS, the proxy package pulls the course content into the browser from the hosted instance of Content Controller. From the learner’s perspective, the content appears to come directly from the Member’s LMS, and the Member can run reporting on all included courses directly from its LMS.

Are Content Controller’s hosted instances secure?
Yes. All hosted instances of Content Controller are hosted on Amazon Web Services (AWS). See AWS’s Compliance Programs for more information on IT security and standards compliance.

What personally identifiable information (PII) does Content Controller collect?
When a learner launches an Industry Advantage course from the Member’s LMS, Content Controller collects the learner’s first and last name as well as the learner ID from the LMS. These data points allow LIMRA and LOMA to track how many subscription seats the Member has used, course usage, and other metrics. All data is securely stored in a U.S.-based Amazon Web Services (AWS) data center.

What is a learner ID?
The Member’s LMS assigns each user a unique ID. The learner ID is usually different from the user name the learner uses to log into the LMS. Sometimes the learner ID is the learner’s email address, and other times it’s a unique GUID (globally unique identifier) generated by the Member’s LMS.

What if I don’t want my learner’s PII collected by Content Controller?
Content Controller has the ability to anonymize or hash learner PII. Hashing takes place in the learner’s browser, anonymizing the PII before it ever reaches Content Controller’s servers or databases. Read more about hashing in Content Controller.

Where can I find more information on Rustici Software’s information security policy?
Rustici Software’s written information security policy (WISP) can be found online here: https://security.rusticisoftware.com/

My IT department requires a vendor risk assessment before we can use Industry Advantage (and Content Controller). How do I request one?
Send an email to IndustryAdvantageSupport@loma.org and we’ll pass along your request to Rustici Software.

What third-party security assessment has LIMRA and LOMA performed on Rustici Software?
LIMRA and LOMA required Rustici Software to complete an attested risk assessment through ProcessUnity (formerly Cyber GRX). Please contact IndustryAdvantageSupport@loma.org to see LIMRA and LOMA’s Cyber GRX report on Rustici Software.

Does LIMRA and LOMA have an architecture diagram for Industry Advantage?
Yes! Industry Advantage Architecture document can be found here.

The Industry Advantage Architecture Diagram references the Rustici Engine learning API. Is this an LMS plug-in or something I need to install?
No. The Rustici Engine learning API is built into Content Controller. You don't need to install anything to access it.

Is there a URL our IT security team can whitelist to ensure communication between servers is not blocked by our firewall?
Yes. https://llglobal.contentcontroller.com

Will my company's LMS Administrator need a login account for Content Controller to use Industry Advantage?
No. Only the LIMRA and LOMA Administrators have login access to Content Controller. We maintain Industry Advantage subscriber accounts on the Content Controller platform.

Will my learners need to log into Content Controller to access Industry Advantage courses?
No. Your LMS authenticates your learners. When they launch an Industry Advantage course, Content Controller and your LMS securely communicate over HTTPS in the background to exchange account and user information.

The courses themselves use whichever learning standard (SCORM, AICC, cmi5, etc) you've requested to communicate course progress and completions back to your LMS and back to Content Controller.

How is course progress and completion data tracked?
The courses themselves use whichever learning standard (SCORM, AICC, cmi5, etc) you've requested to communicate course progress and completions back to your LMS and back to Content Controller.