Skip to main content

Assessment content

A deployment starts with GCA's question bank and recommendation catalog. You can edit both from the admin panel, one item at a time or by uploading a whole file. For the file formats, see Content formats; for how answers become scores, see Scoring.

Question Bank​

The Question Bank page lists every question, filterable by stage, audience, group and category. From it you can add, edit and delete questions, and manage the groups their categories roll up into.

A question has:

  • a stage: 1 (scoping, unscored), 2 (knowledge and tools) or 3 (organizational preparedness, small businesses and nonprofits only);
  • the audiences it is asked of, and optionally different wording per audience;
  • for a scored question, a category and the group that category belongs to;
  • its answers, each with a value. On a scored question the value is the score.

A scoping question's answers can carry a trigger that removes later questions or categories from the assessment, or scores them as zero. See Scoring.

Groups​

Every scored category must belong to exactly one group, and a group belongs to the category rather than the question: moving one question's category to another group moves every question in that category. Results show groups in the order set here, and each group's explanation is shown to learners under their score, so write it for them.

Uploading a whole bank​

Download JSON saves the current bank as a file. Upload Bank JSON replaces the bank with a file. An upload is checked before anything changes, and is refused with the offending entry named if:

  • a scored question has no group, or names a group the file doesn't define;
  • one category is split across two groups.

An upload keeps each question's identity: questions are matched by slug, so a question whose content didn't change keeps its version, and one missing from the file is deleted (and can be restored from its history).

Recommendations​

A recommendation is matched to an assessment by category: any category the learner scores below 70% gets the entry of the same name. Each entry holds:

  • links to resources, by type: GCA Academy courses (thinkific), GCA Cybersecurity Toolkit pages (toolkit), CyberFlex and ACT. Toolkit links can differ per audience;
  • guidance: short advice shown with the links;
  • actions: the steps a learner can add to their roadmap.

Special entries cover learners who have nothing below 70%: one per audience (_defaultConsumer, _defaultSMB and so on) and a final fallback, _knowledgeDefault.

Download JSON and Upload Catalog JSON work as for the question bank, matching entries by name. Re-import seed catalog replaces the catalog with the one that ships with your ScamSafe version. It is how new content from a ScamSafe update reaches a deployment that already has a catalog, and it overwrites your own edits, each change recorded as a new version.

Roadmap actions​

Actions are the steps a learner works through. Each has an id, a title, and optionally an instruction, a link, an estimated time, the audiences it applies to and a kind (protect, practice, learn, process or recover).

  • An action's id is its identity. Roadmaps already built keep their own copy of each step, so editing an action changes future roadmaps only. Changing an id makes it a different step.
  • recover steps are only included for learners who have said something has already happened, or who opt in.
  • An inactive action is never added to a roadmap. New actions should be saved inactive until they're ready.
  • An entry with no actions still works: its roadmap steps are made from its links.

The upload is refused, naming the entry and action, if an action has an unknown kind or audience, or a link that isn't https.