Qualification questionnaire
The questionnaire is the second step of qualification. It lets you assess the project's contextual risk factors: governance, technical environment, exposure to threats.
The role of the questionnaire
The questionnaire complements the scoping cards with structured information. The answers are used by the AI to produce the qualification summary (overall risk level, AICT levels).
It consists of around 20 questions, organised by topic. The exact content of the questionnaire is defined by your organisation's administrators: each organisation can adapt the list to reflect its cyber strategy.
Administrators can modify, add or remove questions from Settings > Cyber Strategy > Pre-qualification questions.
Two completion modes
You can answer the questionnaire in two different ways, depending on your project's maturity and the time available.
Automatic mode
By clicking the Generate button, the AI answers all the questions based on:
- the free-text context entered in the scoping cards
- the imported documents
- the list of assets linked to the project
- the identified processes
- the project description
You can then review the answers, adjust them manually if needed, and complete the detail fields.
Manual mode
You can also answer question by question directly in the interface, without using generation. This mode is useful when you want full control over the answers or when the information is not yet detailed enough in the scoping cards.
We recommend using both modes: you can run a generation, then manually edit some of the answers.
Question format
Each question follows the same format:
| Element | Content |
|---|---|
| Title | Wording of the question |
| Answer | Yes / No |
| Detail | Optional free-text field to justify or clarify the answer |
Example 1
Does the project handle personal data? Answer: ✅ Yes Detail: The project processes the civil status, contact details and contract data of around 120,000 customers. A DPIA has already been initiated by the DPO.
Example 2
Is the project exposed to the Internet? Answer: ✅ Yes Detail: The portal is publicly accessible via an
https://URL, protected by WAF and MFA for authenticated users.
Example 3
Does the project rely on critical external providers? Answer: ❌ No Detail: Hosting and operations are carried out internally by the Infrastructure teams.
The detail field is not mandatory, but it is recommended to fill it in whenever the answer deserves a comment. These justifications are used by the AI in the summary.
A well-argued answer in the detail field weighs more in the summary than a simple Yes / No. Use this field to contextualise your answers.
Move to the next step
Once all the questions are filled in, you can access the Qualification summary to generate the project's overall summary.