Questionnaire Management

Importing a Questionnaire
In most cases, the XML SIG 6.2 questionnaire will already exist in the system, so no questionnaire import will be required.

If a questionnaire does not yet exist in the system, you will need to obtain or create a Questionnaire Definition XML Document (XML Reference). You may use a Responses XML Document instead since it also contains the question data. If you import an invalid XML document, you will receive an XML validation error.

If the file is encrypted with an AES256/RIJNDAEL256 key (see Encryption), you must have imported the key already. Select the key from the drop-down menu. If you do not specify the correct key for an encrypted file, you will receive an XML validation error.

At the top of the page you will see the Import Questionnaire section. Browse for the XML document and click upload. You will then see a processing screen. Once the file has been uploaded, you will see a confirmation message at the top of the screen stating the upload was successful.

Exporting a Questionnaire Definition XML Document
The Questionnaire Definition XML Document defines the questionnaire. This includes the page layout, sections, questions, references, and rules. This document is used to import a questionnaire into QM for SIG.

Use the Export XML feature if you want to export this document so that it can be imported into another system.

First, select a questionnaire from the Select Questionnaire drop-down menu and then find the Export XML section on the page. Select a key from the drop-down menu for an encrypted version if you prefer, and click download.

Deleting a Questionnaire
At the bottom of the page you will find the Delete Questionnaire section. This will permanently remove the questionnaire from the system. If there are instances currently in the system for the questionnaire, you will receive an error stating that you must delete all instances first. Click the delete button to permanently remove the questionnaire from the system.

Instance Management

Begin by click on the Administration button in the upper right corner of the screen and then click Instance Management from the navigation menu on the left.  The Instance Management page is opened.  The various operations that can be performed on a questionnaire instance are shown as tabs across the top of the page.  They are:

• Import XML & Excel - import an instance from XML or Excel
• New - create an instance
• Copy Instance - copy an instance
• Download PDF - create a PDF version of the instance
• Export - export an XML version of the instance
• Delete - delete an instance

Importing an Instance
You may import a questionnaire instance by selecting a Full Responses XML Document, or a Zip Archive of an XML document.  In addition, you can select a Shared Assessments Program Excel document in version 5.0, 6.0 or 6.2 format.  In this case, the imported, converted XML instance will be in version 6.2 format.  Next, enter a name to identify the instance in the Instance Name text box. Then select how you want to handle responses. There are 3 options:

• Import XML Responses: This imports all responses contained in the XML Document.
• Import Instance Responses: This selects an existing instance from the system. This option merges all responses from an existing instance into the one you are importing. This is accomplished by matching question GUIDs that are shared by both instances as defined by each questionnaire definition.  This is useful when migrating to later versions of the SIG questionnaire.
• Do not import any responses: If you do not select either of the import options then no responses will be imported from the source document.  This creates a new instance with no responses.

Finally, click Submit to import the XML Document.

Alternatively, you may select a Questionnaire Definition XML Document for import. This will always create an instance with no responses.

If you are importing an instance that contains attachments, you must import it as a Zip Archive. Otherwise, you will receive an error.

Creating a New Instance
To create a new instance of a questionnaire that is already known in the system, click on the New tab. Select the questionnaire (and possibly domain) in the Selection Questionnaire drop-down menu. Next, enter a name to identify the new instance in the Instance Name text box. You can choose whether you want to import any responses in the existing questionnaire or not.  Finally, click Submit to create the new instance.

Exporting an Instance in XML Format
To export an instance in XML format, click on the tab labeled Export. Select a questionnaire and instance from the drop-down lists. After identifying the instance to be exported, you will see two options:

• XML Only: This XML document contains both question and response information.  It is used to import an instance into this or another installation of QM for SIG or another enterprise risk management system.
• Zip Archive: If you have attachments, you must export the instance using this option.  The export will contain the XML document described above along with attachments associated with the instance.

If your instance contains attachments, you will be able to import the instance into this or another QM for SIG system only if you choose the Zip Archive export. Only Zip Archives contain attachment data.

Exporting an Instance in PDF Format
To export an instance in PDF format, click on the tab labeled Download PDF.  Select a questionnaire and instance from the drop-down menus.  After selecting the instance, several options appear to allow you to customize the PDF format.  Below the Download PDF button is a series of check boxes that allow you to select which pages on the questionnaire you want to be included in the PDF file. Below that are options for specifying an image to appear on the title page, as well as text for the title page and page footers.  Once you click on the Download PDF button, you can either open the PDF file or save it.  You can also choose to encrypt the PDF file if desired.

Copying an Instance
Copying an instance creates a new instance with the same responses but with a new name. To copy an instance, click on the Copy Instance tab.  Select a questionnaire and instance from the drop-down menus. Enter a name to identify the new instance in the Instance Name text box. Finally, click Submit to create the new instance.

Deleting an Instance
Deleting an instance permanently removes the instance from the system. The Questionnaire Definition XML Document remains in the system unless you delete this as well from the Questionnaire Management page. To delete an instance, click on the Delete tab.  Select a questionnaire and instance from the drop-down menus. Click on Delete to delete the instance.

Encryption Management

QM for SIG supports RIJNDAEL256 secret key encryption. These keys may be used to encrypt your exported questionnaire or instance data. In order for two QM for SIG installations to share encrypted data, both must contain the same key.

Creating a New Key

Start by clicking on the Administration button in the upper right corner. Then click Encryption Management from the options menu on the left. In the create key box, type a profile name to identify the key and click create key. You will then see the key encoded in Base64 listed under encryption keys.

You may optionally specify a secret. This is a string or phrase longer than 8 characters. If you specify a secret, the key is derived from the secret. This is useful if you do not have a way to securely transmit the key. You can then call the trusted entity and tell them the secret phrase which is easier than relaying the raw key. See the guidelines below for more information.

Importing a Key
To import a Base64-encoded RIJNDAEL256 key, go to the section called import key. Type a profile name to identify the key and enter the entire key in the key text box. After clicking import key you will see the key listed at the top of the page under encryption keys.

Modifying Key Profiles
Once a key has been created, you will find the key listed in the encryption keys box. If you have many keys, you may need to search for the key profile name using the text box at the top of the page. When hovering over a key with your mouse, you may pick from 2 actions:

• Edit: Allows you to rename the profile name.
• Delete: Deletes the key from the system.

Guidelines
It is recommended you review the following guidelines if you are working with sensitive data:

• You must send your key to the intended recipient(s). The recipient will then import the key into their QM for SIG application. For maximum security, it is recommended that you do not specify a secret and send the entire key through a secure transmission. Secure delivery may be an existing trusted electronic transmission (e.g., sftp, scp, ssl) or physical delivery on an external storage device (e.g., flash drive, cd, dvd, etc).
• If secure delivery of the key is not possible, you can still achieve moderate security by specifying a secret. When a secret is specified, the key is derived from the secret. This allows you to tell the recipient via telephone. Specifying more words and uncommon phrases increases security.
• It is not recommended that you send your key insecurely. For example, email is normally insecure. You may, however, send subsequent data encrypted with the key through insecure transmissions since only those that have the key can decrypt it.