Skip to main content

Assessment & Questionnaire System

Infracast's Assessment & Questionnaire System lets you capture evidence for compliance controls that cannot be evaluated by automated infrastructure scanning alone — things like security awareness training, physical access procedures, incident response drills, and personnel security reviews.

Overview​

Not every compliance control maps to a scannable infrastructure property. Many NIST 800-171, CMMC, and FedRAMP controls require human attestation backed by documented evidence. The Questionnaire System bridges that gap:

Automated Rules          Questionnaire System
─────────────────        ──────────────────────────────────
Scan infrastructure  +   Assign questions to responsible
Check properties         parties → Collect answers →
Evaluate rules           Upload evidence → Review & approve
      │                              │
      └──────────────┬───────────────┘
                     ▼
              Combined Compliance Score
              (Automated + Attested controls)

Key Capabilities​

CapabilityDescription
Template Library20+ pre-built questionnaire templates across 4 languages
Flexible AssignmentAssign questionnaires to specific users or user groups
Draft SavingRespondents can save partial answers and return later
Evidence UploadsAttach PDFs, screenshots, and policy documents per question
Multi-stage ReviewSubmit for review → Reviewer approves or requests changes
Expiration & RenewalSet attestation expiry; system notifies before lapse
Framework MappingEach question maps to specific NIST/CMMC/FedRAMP controls
Multi-languageTemplates available in EN, DE, FR, PT

How It Works​

Step 1: Create a Questionnaire​

Create from a pre-built template or build a custom questionnaire:

# Create from template
POST /api/v1/tenants/{tenantID}/questionnaires/from-template
{
  "template_id": "cmmc-l2-at",
  "title": "CMMC L2 Awareness & Training Assessment — Q2 2026",
  "description": "Annual security awareness training attestation",
  "assignees": ["training-lead@company.com", "hr-manager@company.com"],
  "due_date": "2026-05-31",
  "framework": "cmmc-l2"
}

# Or create a custom questionnaire
POST /api/v1/tenants/{tenantID}/questionnaires
{
  "title": "Custom Physical Security Review",
  "questions": [
    {
      "id": "q1",
      "text": "Describe your data center physical access controls.",
      "type": "text_long",
      "required": true,
      "control_mappings": ["NIST-PE-1", "CMMC-PE.1.131"]
    },
    {
      "id": "q2",
      "text": "Upload your most recent physical security audit report.",
      "type": "file_upload",
      "required": true,
      "accepted_types": ["pdf", "docx"]
    }
  ],
  "assignees": ["facilities-lead@company.com"],
  "due_date": "2026-05-15"
}

Step 2: Respondent Answers Questions​

Assigned users receive a notification and access the questionnaire through the Infracast UI or API.

Save a draft (partial answers):

PUT /api/v1/tenants/{tenantID}/questionnaires/{questionnaireID}/responses/draft
{
  "answers": {
    "q1": "Access is controlled via badge readers and security guards...",
    "q2": null  // not yet answered
  }
}

Submit completed questionnaire for review:

POST /api/v1/tenants/{tenantID}/questionnaires/{questionnaireID}/responses/submit
{
  "answers": {
    "q1": "Access is controlled via badge readers and 24/7 security guards. All visitors are escorted.",
    "q2": "attachment:evidence-upload-abc123"
  },
  "attestation_statement": "I certify that the above information is accurate to the best of my knowledge.",
  "attested_by": "facilities-lead@company.com"
}

Step 3: Reviewer Approves or Requests Changes​

Compliance officers or security administrators review submitted responses:

# Approve
POST /api/v1/tenants/{tenantID}/questionnaires/{questionnaireID}/review
{
  "action": "approve",
  "reviewer_notes": "Documentation reviewed and found sufficient.",
  "expiry_date": "2027-05-15"
}

# Request changes
POST /api/v1/tenants/{tenantID}/questionnaires/{questionnaireID}/review
{
  "action": "request_changes",
  "reviewer_notes": "Please upload the signed physical access log from Q1 2026."
}

Step 4: Controls Marked Attested​

Once approved, the mapped compliance controls are marked as Attested with an expiry date. Attested controls contribute to your overall compliance score alongside automated findings.

Control Status Flow:
  Not Assessed → Questionnaire Assigned → In Progress → Submitted → Attested ✅
                                                              ↓
                                                    Changes Requested → In Progress

Lifecycle Diagram​

┌──────────────────────────────────────────────────────────────────┐
│                   Questionnaire Lifecycle                        │
├──────────────────────────────────────────────────────────────────┤
│                                                                  │
│  Template Library                                                │
│       │                                                          │
│       ▼                                                          │
│  Create Questionnaire ──── Assign to Users                       │
│       │                                                          │
│       ▼                                                          │
│  Respondent Opens ──── Save Draft ──► (Return Later)            │
│       │                                                          │
│       ▼                                                          │
│  Answer Questions + Upload Evidence                              │
│       │                                                          │
│       ▼                                                          │
│  Submit for Review                                               │
│       │                                                          │
│       ├─── Approved ──► Controls Attested (with expiry)         │
│       │                      │                                   │
│       │                      ▼                                   │
│       │              Near Expiry Alert                           │
│       │                      │                                   │
│       │                      ▼                                   │
│       │              Renewal Questionnaire                       │
│       │                                                          │
│       └─── Changes Requested ──► Back to Respondent             │
│                                                                  │
└──────────────────────────────────────────────────────────────────┘

Pre-Built Templates​

Infracast ships 20 questionnaire templates covering the most common attestation requirements:

Template IDFrameworkDomainPractices Covered
cmmc-l2-atCMMC L2Awareness & TrainingAT.2.056, AT.2.057, AT.3.058
cmmc-l2-peCMMC L2Physical ProtectionPE.1.131, PE.1.132, PE.2.135
cmmc-l2-psCMMC L2Personnel SecurityPS.2.127, PS.3.131
cmmc-l2-irCMMC L2Incident ResponseIR.2.092, IR.2.093, IR.2.097
cmmc-l2-maCMMC L2MaintenanceMA.2.111, MA.2.112
nist171-atNIST 800-171Awareness & Training3.2.1, 3.2.2, 3.2.3
nist171-peNIST 800-171Physical Protection3.10.1–3.10.6
nist171-psNIST 800-171Personnel Security3.9.1, 3.9.2
nist171-dfarsDFARS 252.204-7012CDI SafeguardingIncident reporting, flow-down, cloud
fedramp-irFedRAMP ModerateIncident ResponseIR-1 through IR-8
fedramp-atFedRAMP ModerateAwareness & TrainingAT-2, AT-3, AT-4
fedramp-peFedRAMP ModeratePhysical ProtectionPE-1 through PE-20
vendor-riskSOC 2Vendor RiskCC9.2
bcp-testSOC 2 / ISO 27001Business ContinuityA.17.1.3
hipaa-trainingHIPAAWorkforce Training§164.530(b)
hipaa-sanctionsHIPAASanctions Policy§164.530(e)
gdpr-dpiaGDPRData Protection ImpactArticle 35
iso-supplierISO 27001Supplier RelationshipsA.15.1.1–A.15.2.2
nerc-opsNERC CIPOperational ProceduresCIP-007, CIP-010
sox-changeSOX ITChange ManagementCC8.1

Templates are available in English (EN), German (DE), French (FR), and Portuguese (PT).

API Reference​

Templates​

# List all templates
GET /api/v1/tenants/{tenantID}/questionnaires/templates

# Filter by framework
GET /api/v1/tenants/{tenantID}/questionnaires/templates?framework=cmmc-l2

# Get template details
GET /api/v1/tenants/{tenantID}/questionnaires/templates/{templateID}

Questionnaires​

# Create from template
POST /api/v1/tenants/{tenantID}/questionnaires/from-template

# Create custom
POST /api/v1/tenants/{tenantID}/questionnaires

# List all questionnaires
GET /api/v1/tenants/{tenantID}/questionnaires

# Get questionnaire status
GET /api/v1/tenants/{tenantID}/questionnaires/{questionnaireID}

# Get assigned questionnaires (respondent view)
GET /api/v1/tenants/{tenantID}/questionnaires/assigned?assignee=user@company.com

Responses​

# Save draft
PUT /api/v1/tenants/{tenantID}/questionnaires/{questionnaireID}/responses/draft

# Submit for review
POST /api/v1/tenants/{tenantID}/questionnaires/{questionnaireID}/responses/submit

# Upload evidence file
POST /api/v1/tenants/{tenantID}/questionnaires/{questionnaireID}/evidence
Content-Type: multipart/form-data
file=@training-completion-report-2026.pdf&question_id=q2

Review​

# Approve or request changes
POST /api/v1/tenants/{tenantID}/questionnaires/{questionnaireID}/review

# List pending reviews
GET /api/v1/tenants/{tenantID}/questionnaires?status=submitted&reviewer=compliance-officer@company.com

Attestations​

# List all attested controls
GET /api/v1/tenants/{tenantID}/attestations

# Filter by framework and expiry
GET /api/v1/tenants/{tenantID}/attestations?framework=cmmc-l2&expires_before=2026-12-31

# Get attestation with evidence chain
GET /api/v1/tenants/{tenantID}/attestations/{attestationID}?include_evidence=true

Integration with Compliance Scoring​

Attested controls are weighted equally to automated controls in your compliance score:

Overall Score = (Passing Automated + Attested Approved) / Total Applicable × 100

In the compliance dashboard, attested controls are displayed with a distinct badge:

✅ NIST-AT-2  — Attested by training-lead@company.com on 2026-04-01 (expires 2027-04-01)
🔴 NIST-PE-2  — Questionnaire assigned, awaiting response (due 2026-05-31)
⏳ NIST-IR-4  — Submitted, pending reviewer approval

Expiry & Renewal​

Infracast tracks attestation expiry and sends proactive notifications:

TimeframeAction
60 days before expiryEmail reminder to attestation owner
30 days before expirySecond reminder + dashboard warning
7 days before expiryUrgent alert; compliance score shows "expiring soon"
ExpiredControl reverts to "Not Assessed" — score drops

Renewal creates a new questionnaire pre-populated with prior answers to speed completion.

Next Steps​