How to Create and Manage Questionnaires

Questionnaires are the question sets you send to entities to assess their security. There are two types: Entity questionnaires, which produce a maturity score, can map to frameworks such as NIST and the Master Control Framework, and can link to your Issues and Capabilities Assessment; and Standard questionnaires, which are a simple form with no scoring. You build a questionnaire as a CSV and upload it. This article covers creating, uploading, and maintaining them.

Building the questionnaire CSV

You can download the template for the questionnaire from the 'Upload Questionnaire' option next to the 'Manage Questionnaires' page header. The menu it opens will have a 'Download standard questionnaire template' option you can use to get the template.

A questionnaire is defined in a CSV, where each row is a question. The key columns are:

• Index: a unique ID for each question, used to reference it.
• Section1 and Section2: the category (mandatory) and optional subcategory the question sits under.
• Question and Answers: the question text and its answer options (Answer1, Answer2, and so on).
• Question Type: single choice, multiple choice, or comment, with a Scoring Type of Sum or Max for multiple-choice questions.
• Comment and Attachment requirements: whether a comment or attachment is required, and any dependencies that show a question only when a prior answer is given.
• Entity-only columns: Answer Points, NIST Mapping, and MCF Mapping, which drive the maturity score and framework mapping. Standard questionnaires omit these.

Uploading a questionnaire

1. Navigate to Assessments > Questionnaire and click Upload questionnaire. The book icon opens the full formatting instructions.
2. Enter a Name, select the Type (Entity), choose your .csv file, and click Upload.
3. After the upload, give your workspace a minute to process the questionnaire and any attached mappings, and then refresh your page. The questionnaire should now be listed alongside your existing questionnaires in the 'Open' section. 

Questionnaire status

Every questionnaire is Open, Closed or Archived. Only an Open questionnaire accepts answers: if you close one while an entity is partway through, their saved work is kept but they cannot add to it. Close a questionnaire when you want to stop new responses without losing the ones you have, and archive it when it is no longer part of your programme.

Scoring an assessment automatically

A questionnaire can carry acceptance and rejection thresholds, expressed as a percentage of the available points. Where every questionnaire on a self-assessment has them set, CyberHQ scores the submission against those thresholds and records the outcome without a reviewer.

This suits high-volume, low-risk assessments where a human review adds little. It is worth being deliberate about it, because an assessment decided this way is accepted or rejected with no one having read the answers. Leave thresholds unset on anything where the findings matter.

[VERIFY: where the thresholds are configured, and confirm auto-decision applies only to self-assessments rather than all entity assessments.]