Managing Questionnaires

The Manage Questionnaires tab is a directory of assessment questionnaires available for a tenant. This tab provides a centralized location where users can perform various actions, such as creating new questionnaires, modifying existing ones, importing questionnaires from external sources, or deleting no longer needed questionnaires.

The primary objectives of assessment questions are twofold. First, they aim to bolster the effectiveness and thoroughness of the assessment process by providing additional context and relevant information. By including well-crafted questions, the assessment becomes more comprehensive and capable of capturing a broader range of data.

Second, the information collected through these assessment questions is crucial in generating meaningful findings when the assessment is completed and submitted as a report. These findings, derived from the accumulated data, serve as valuable insights and recommendations.

Furthermore, the Manage Questionnaires tab also provides the functionality to initiate client assessments. This feature streamlines the assessment workflow by seamlessly integrating the questionnaire creation and initiation steps within the same interface.

Creating a Questionnaire

Step 1: Click New Questionnaire from the Manage Questionnaires tab of the Assessments module.

Step 2: Enter a unique title and select the reference framework from the pulldown menu.

The reference framework value tags assessments and questions for future categorization and management.

Step 3: Click Create Questionnaire.

The "Edit Questionnaire" page has been launched. This page has multiple sections that are further explained below.

Questionnaire Basic Info Section

Step 4: Edit this section as needed.

• Questionnaire Title (required): This value entered in Step 3 can be edited here. This value will appear in the expanded section of the questionnaire (reference number one in the question example below).

• Reference Framework: This value was selected in Step 3 and cannot be edited. The reference framework value tags assessments and questions for future categorization and management.

• Require Completion of All Questions: If all questions must be answered before completing the assessment, check the box.

Step 5: Click Save Basic Info.

Create a New Question Section

• Title (required): Question title and value that will appear in the expanded section of the questionnaire (see number 1 in the example below).

• Description (required): Description of the question that will appear as additional context for the user when answering the question (see number 2 in the example below).

• Answer Types (required): Header value for multiple-choice questions (see number 3 in the example below). Additional multiple-choice questions can be added by clicking Add Answer Type, which is helpful for assessments that score off multiple categories, such as Process and Practice maturity in CMMC. Check the box under "Require?" to make answering the question mandatory when completing the assessment. The list of values available for each multiple-choice question can be previewed by hovering over the informational icon to the right of the "Answer Types" label (but only admins can edit answer type labels and answer type values).

• Add Input Field: An additional label can be provided and made mandatory if necessary (see number 4 in the example below). The label will be presented to the user with a box for data entry. Enter as many Input Fields as required.

• Add Custom Field: Provides additional RTF fields with a label, if needed. Repeat as often as needed.

Custom Button Fields

• Default Severity: Pulldown menu list of values to define the default severity of the question. If a question is based on a Framework Control, it may have a predefined severity. This will be the severity of the report finding that this question will become upon submission.

• Default Score: Optional method for providing a default score.

• Default Score Calculation: If required, enter as a plain text string.

• Tags: Additional information to improve search and reporting.

• Recommendations: Recommendations relevant to the question, such as a remediation technique or policy suggestion.

• References: References to questions to assist with implementing or verifying the assertion, such as website links.

Writeups DB Button

Information from a writeup can be linked to a question. This metadata and content from the writeup will not appear in the assessment. Still, after the assessment is submitted and the question becomes a finding, the writeup information is included on the finding detail page.

• Writeup: Pulldown menu list of available writeups to link to the question.

• Tags: Additional information to improve search and reporting. This is the same field found under the "Custom" button.

Not every field edited for a question will be displayed during the assessment. Still, it will be passed to a finding in the report generated upon submission, as each question in the assessment will become a finding. The screenshot below illustrates this: Every field greyed out and below the yellow line will not appear in the assessment but will be passed on to the finding details page after an assessment is submitted.

Step 6: Click Create.

The created question now appears in the "All Questions" column on the left.

All Questions Section

This section contains a record of all questions in an assessment and provides the sequence in which they will appear.

Step 7: Create more questions to complete the assessment. This can be done in two ways:

1. Clicking Add Question brings up a new blank list of fields.
2. Clicking the copy icon of the question to clone.

Step 8: Click Create after completing the second question. Create as many questions as needed to complete the assessment.

After multiple questions exist, the ability to sequence each question is provided should the creation of steps be outside the desired final sequence.

Questions can be moved by clicking the "All Questions" question box and dragging it to the desired arrangement on the list. The numbering will dynamically change so that they are ordered as shown on the page (i.e., the question on top is always Question #1).

Importing a Questionnaire

PlexTrac allows questionnaires in JSON file format to be imported.

Step 1: From the Assessments module, click the Manage Questionnaires tab.

Step 2: Click Import.

Step 3: Drag the JSON file to the modal or click to browse the file on the computer. Repeat if necessary. When finished, click Upload.

Importing a questionnaire removes all linked writeups.

If the wrong JSON file is used, an error message will appear. If the import is successful, the new file will appear in the list of questionnaires.

Exporting a Questionnaire

A questionnaire can be exported as a JSON file for backup or imported to another instance. Questionnaires can be exported during editing or directly from the Manage Questionnaires page.

Option 1

Step 1: From the Assessments module, click the Manage Questionnaires tab.

Step 2: Click the three dots under the "Actions" menu of the questionnaire and then click Export.

Step 3: A confirmation appears. Click Export.

The questionnaire is downloaded locally as a JSON file.

Option 2

Step 1: From the Assessments module, click the Manage Questionnaires tab.

Step 2: Click Edit under the "Actions" menu of the questionnaire to export.

Step 3: Click Export.

The questionnaire is downloaded locally as a JSON file.

Previewing a Questionnaire

Clicking the row of the questionnaire on the Manage Questionnaire tab displays all question titles, descriptions, and tags. The questions are listed in sequence.