Assessment & Questionnaire System

Infracast's Assessment & Questionnaire System lets you capture evidence for compliance controls that cannot be evaluated by automated infrastructure scanning alone — things like security awareness training, physical access procedures, incident response drills, and personnel security reviews.

Overview

Not every compliance control maps to a scannable infrastructure property. Many NIST 800-171, CMMC, and FedRAMP controls require human attestation backed by documented evidence. The Questionnaire System bridges that gap:

Automated Rules          Questionnaire System
─────────────────        ──────────────────────────────────
Scan infrastructure  +   Assign questions to responsible
Check properties         parties → Collect answers →
Evaluate rules           Upload evidence → Review & approve
      │                              │
      └──────────────┬───────────────┘
                     ▼
              Combined Compliance Score
              (Automated + Attested controls)

---

Key Capabilities

Capability	Description
Template Library	20+ pre-built questionnaire templates across 4 languages
Flexible Assignment	Assign questionnaires to specific users or user groups
Draft Saving	Respondents can save partial answers and return later
Evidence Uploads	Attach PDFs, screenshots, and policy documents per question
Multi-stage Review	Submit for review → Reviewer approves or requests changes
Expiration & Renewal	Set attestation expiry; system notifies before lapse
Framework Mapping	Each question maps to specific NIST/CMMC/FedRAMP controls
Multi-language	Templates available in EN, DE, FR, PT

---

How It Works

Step 1: Create a Questionnaire

Create from a pre-built template or build a custom questionnaire:

# Create from template
POST /api/v1/tenants/{tenantID}/questionnaires/from-template
{
  "template_id": "cmmc-l2-at",
  "title": "CMMC L2 Awareness & Training Assessment — Q2 2026",
  "description": "Annual security awareness training attestation",
  "assignees": ["training-lead@company.com", "hr-manager@company.com"],
  "due_date": "2026-05-31",
  "framework": "cmmc-l2"
}

# Or create a custom questionnaire
POST /api/v1/tenants/{tenantID}/questionnaires
{
  "title": "Custom Physical Security Review",
  "questions": [
    {
      "id": "q1",
      "text": "Describe your data center physical access controls.",
      "type": "text_long",
      "required": true,
      "control_mappings": ["NIST-PE-1", "CMMC-PE.1.131"]
    },
    {
      "id": "q2",
      "text": "Upload your most recent physical security audit report.",
      "type": "file_upload",
      "required": true,
      "accepted_types": ["pdf", "docx"]
    }
  ],
  "assignees": ["facilities-lead@company.com"],
  "due_date": "2026-05-15"
}

Step 2: Respondent Answers Questions

Assigned users receive a notification and access the questionnaire through the Infracast UI or API.

Answers are saved against the assessment — the assigned instance — not against the questionnaire definition. Saving answers is incremental; you can call respond as many times as you like until the assessment is submitted.

Save answers (partial or complete):

POST /api/v1/tenants/{tenantID}/assessments/{aID}/respond
{
  "responses": [
    {
      "question_id": "q1",
      "answer": "Access is controlled via badge readers and security guards...",
      "notes": "Reviewed with the facilities team"
    }
  ]
}

Submit the completed assessment for review:

POST /api/v1/tenants/{tenantID}/assessments/{aID}/submit

Once an assessment is submitted or approved it becomes read-only — further respond calls are rejected with a 400.

Step 3: Reviewer Approves or Requests Changes

Compliance officers or security administrators review submitted responses:

# Approve
POST /api/v1/tenants/{tenantID}/assessments/{aID}/review
{
  "review_status": "approved",
  "notes": "Documentation reviewed and found sufficient."
}

# Reject / request changes
POST /api/v1/tenants/{tenantID}/assessments/{aID}/review
{
  "review_status": "rejected",
  "notes": "Please upload the signed physical access log from Q1 2026."
}

# Convenience aliases for the same action
POST /api/v1/tenants/{tenantID}/assessments/{aID}/approve
POST /api/v1/tenants/{tenantID}/assessments/{aID}/reject

Step 4: Controls Marked Attested

Once approved, the mapped compliance controls are marked as Attested with an expiry date. Attested controls contribute to your overall compliance score alongside automated findings.

Control Status Flow:
  Not Assessed → Questionnaire Assigned → In Progress → Submitted → Attested ✅
                                                              ↓
                                                    Changes Requested → In Progress

---

Lifecycle Diagram

┌──────────────────────────────────────────────────────────────────┐
│                   Questionnaire Lifecycle                        │
├──────────────────────────────────────────────────────────────────┤
│                                                                  │
│  Template Library                                                │
│       │                                                          │
│       ▼                                                          │
│  Create Questionnaire ──── Assign to Users                       │
│       │                                                          │
│       ▼                                                          │
│  Respondent Opens ──── Save Draft ──► (Return Later)            │
│       │                                                          │
│       ▼                                                          │
│  Answer Questions + Upload Evidence                              │
│       │                                                          │
│       ▼                                                          │
│  Submit for Review                                               │
│       │                                                          │
│       ├─── Approved ──► Controls Attested (with expiry)         │
│       │                      │                                   │
│       │                      ▼                                   │
│       │              Near Expiry Alert                           │
│       │                      │                                   │
│       │                      ▼                                   │
│       │              Renewal Questionnaire                       │
│       │                                                          │
│       └─── Changes Requested ──► Back to Respondent             │
│                                                                  │
└──────────────────────────────────────────────────────────────────┘

---

Pre-Built Templates

Infracast ships 20 questionnaire templates covering the most common attestation requirements:

Template ID	Framework	Domain	Practices Covered
cmmc-l2-at	CMMC L2	Awareness & Training	AT.2.056, AT.2.057, AT.3.058
cmmc-l2-pe	CMMC L2	Physical Protection	PE.1.131, PE.1.132, PE.2.135
cmmc-l2-ps	CMMC L2	Personnel Security	PS.2.127, PS.3.131
cmmc-l2-ir	CMMC L2	Incident Response	IR.2.092, IR.2.093, IR.2.097
cmmc-l2-ma	CMMC L2	Maintenance	MA.2.111, MA.2.112
nist171-at	NIST 800-171	Awareness & Training	3.2.1, 3.2.2, 3.2.3
nist171-pe	NIST 800-171	Physical Protection	3.10.1–3.10.6
nist171-ps	NIST 800-171	Personnel Security	3.9.1, 3.9.2
nist171-dfars	DFARS 252.204-7012	CDI Safeguarding	Incident reporting, flow-down, cloud
fedramp-ir	FedRAMP Moderate	Incident Response	IR-1 through IR-8
fedramp-at	FedRAMP Moderate	Awareness & Training	AT-2, AT-3, AT-4
fedramp-pe	FedRAMP Moderate	Physical Protection	PE-1 through PE-20
vendor-risk	SOC 2	Vendor Risk	CC9.2
bcp-test	SOC 2 / ISO 27001	Business Continuity	A.17.1.3
hipaa-training	HIPAA	Workforce Training	§164.530(b)
hipaa-sanctions	HIPAA	Sanctions Policy	§164.530(e)
gdpr-dpia	GDPR	Data Protection Impact	Article 35
iso-supplier	ISO 27001	Supplier Relationships	A.15.1.1–A.15.2.2
nerc-ops	NERC CIP	Operational Procedures	CIP-007, CIP-010
sox-change	SOX IT	Change Management	CC8.1

Templates are available in English (EN), German (DE), French (FR), and Portuguese (PT).

---

API Reference

Two resources, not one

A questionnaire is the reusable definition — its questions, and who it is assigned to. An assessment is one assigned instance of that questionnaire that a respondent fills in and a reviewer approves. Responses and review actions are performed against the assessment, not against the questionnaire.

Templates

# List available templates, optionally filtered
GET /api/v1/tenants/{tenantID}/questionnaires/templates
GET /api/v1/tenants/{tenantID}/questionnaires/templates?framework=cmmc-l2

Questionnaires

# Create from a template, or create a custom one
POST /api/v1/tenants/{tenantID}/questionnaires/from-template
POST /api/v1/tenants/{tenantID}/questionnaires

# List, read, update, delete
GET    /api/v1/tenants/{tenantID}/questionnaires
GET    /api/v1/tenants/{tenantID}/questionnaires/{qID}
PUT    /api/v1/tenants/{tenantID}/questionnaires/{qID}
DELETE /api/v1/tenants/{tenantID}/questionnaires/{qID}

# Publish, then assign to respondents (assigning creates assessments)
POST /api/v1/tenants/{tenantID}/questionnaires/{qID}/publish
POST /api/v1/tenants/{tenantID}/questionnaires/{qID}/assign

# Manage questions
POST   /api/v1/tenants/{tenantID}/questionnaires/{qID}/questions
PUT    /api/v1/tenants/{tenantID}/questionnaires/{qID}/questions/{questionID}
DELETE /api/v1/tenants/{tenantID}/questionnaires/{qID}/questions/{questionID}

Assessments — responding

# List assessments; "mine" is the respondent view
GET /api/v1/tenants/{tenantID}/assessments
GET /api/v1/tenants/{tenantID}/assessments/mine
GET /api/v1/tenants/{tenantID}/assessments/{aID}

# Answer questions, then submit for review
POST /api/v1/tenants/{tenantID}/assessments/{aID}/respond
POST /api/v1/tenants/{tenantID}/assessments/{aID}/submit

Assessments — reviewing

# Reviewer work queue
GET /api/v1/tenants/{tenantID}/assessments/review-queue

# Record a review decision
POST /api/v1/tenants/{tenantID}/assessments/{aID}/review

# Convenience aliases for the same action
POST /api/v1/tenants/{tenantID}/assessments/{aID}/approve
POST /api/v1/tenants/{tenantID}/assessments/{aID}/reject

# Raise POA&M items from a rejected or gapped assessment
POST /api/v1/tenants/{tenantID}/assessments/{aID}/generate-poam

Attestation evidence

Evidence files are attached to attestations through the attestation-evidence collection.

GET    /api/v1/tenants/{tenantID}/attestation-evidence
POST   /api/v1/tenants/{tenantID}/attestation-evidence      # multipart upload, 50 MiB max
GET    /api/v1/tenants/{tenantID}/attestation-evidence/{eID}
GET    /api/v1/tenants/{tenantID}/attestation-evidence/{eID}/download

API paths corrected 2026-09-14

This section previously documented a /questionnaires/{id}/responses/..., /review, and /attestations surface that does not exist in the API — those calls returned 404. Responses and reviews are performed against assessments, and evidence lives under attestation-evidence. The paths above are verified against the router.

---

Integration with Compliance Scoring

Attested controls are weighted equally to automated controls in your compliance score:

Overall Score = (Passing Automated + Attested Approved) / Total Applicable × 100

In the compliance dashboard, attested controls are displayed with a distinct badge:

✅ NIST-AT-2  — Attested by training-lead@company.com on 2026-04-01 (expires 2027-04-01)
🔴 NIST-PE-2  — Questionnaire assigned, awaiting response (due 2026-05-31)
⏳ NIST-IR-4  — Submitted, pending reviewer approval

---

Expiry & Renewal

Infracast tracks attestation expiry and sends proactive notifications:

Timeframe	Action
60 days before expiry	Email reminder to attestation owner
30 days before expiry	Second reminder + dashboard warning
7 days before expiry	Urgent alert; compliance score shows "expiring soon"
Expired	Control reverts to "Not Assessed" — score drops

Renewal creates a new questionnaire pre-populated with prior answers to speed completion.

---

Next Steps

• CMMC Guide — CMMC L2 assessment workflow with questionnaires
• NIST 800-171 Guide — NIST practices that require attestation
• Evidence Engine — Automated evidence collection for automatable controls
• Compliance Overview — Full framework list and scoring methodology