Content formats

The file formats for uploading a whole question bank or recommendation catalog from the admin panel. The easiest way to start a file is to download the current one (Download JSON) and edit it. For what each field does in the assessment, see Scoring and Assessment content.

Audiences

Audience-keyed fields use these names:

Name	Audience
consumer	Individual
youngAdult	Young adult
senior	Senior
smb	Small business
nonprofit	Nonprofit

Question bank

An object holding the groups and the questions:

{
  "groups": [
    {
      "key": "verify",
      "name": "Verify before you act",
      "explanation": "Whether you check a request is genuine before you respond to it."
    }
  ],
  "entries": [
    {
      "slug": "scope-unexpected-contact",
      "stage": 1,
      "audiences": ["consumer", "youngAdult", "senior", "smb", "nonprofit"],
      "question": {
        "prompt": "Do you get emails, texts or calls you weren't expecting?",
        "answers": [
          { "value": 1, "text": "Yes" },
          { "value": 0, "text": "No", "trigger": { "targets": ["verify-another-way"], "action": "exclude" } }
        ]
      },
      "scale": "yesNo"
    },
    {
      "slug": "verify-unexpected-requests",
      "stage": 2,
      "audiences": ["consumer", "youngAdult", "senior", "smb", "nonprofit"],
      "question": {
        "prompt": "When an unexpected message asks you to act urgently, what do you usually do?",
        "answers": [
          { "value": 0, "text": "I usually act on it or I do not know what to do." },
          { "value": 3, "text": "I verify the request independently before acting." }
        ]
      },
      "scale": "individual3",
      "category": "verify-another-way",
      "group": "verify"
    }
  ]
}

Groups

Field
key	The group's identifier, referenced by entries' group
name	Shown to learners
explanation	Shown to learners under their group score, and given to the tutor

Groups appear in results in the order they are listed.

Entries

Field
slug	The question's permanent identifier. Uploads match questions by it
stage	1 scoping, 2 knowledge and tools, 3 organizational preparedness
audiences	Who is asked this question
question	{prompt, answers}, or an object keyed by audience name holding a {prompt, answers} for each, to word the question differently per audience
scale	yesNo (stage 1, unscored), individual3 (0 to 3) or orgNist5 (0 to 5)
category	Scored questions: the category the score counts towards
group	Scored questions: the key of the group the category belongs to

Each answer has a value (its score, on a scored question) and text. On a stage 1 question an answer can carry a trigger:

Field
targets	Category names or question slugs
action	exclude removes the targets from the assessment; scoreZero scores them 0

Validation

An upload is refused, naming the problem, if:

• a scored entry has no group, or names one the file doesn't define;
• one category's questions name different groups.

Recommendation catalog

An array of entries. An entry's name is the category it covers:

[
  {
    "name": "account-takeover",
    "category": ["account-takeover"],
    "thinkific": ["https://edu.globalcyberalliance.org/courses/creating-strong-passwords-two-factor-authentication-individuals"],
    "toolkit": ["https://gcatoolkit.org/individuals/beyond-simple-passwords/"],
    "toolkitByAudience": {
      "consumer": ["https://gcatoolkit.org/individuals/beyond-simple-passwords/"],
      "smb": ["https://gcatoolkit.org/smallbusiness/beyond-simple-passwords/"]
    },
    "cyberflex": [],
    "act": [],
    "guidance": ["Respond: while you still have access, change that password and turn on multi-factor authentication."],
    "note": "",
    "actions": [
      {
        "id": "account-takeover.mfa-email",
        "title": "Turn on two-step verification for your main email account",
        "instruction": "Your email resets every other password, so protect it first.",
        "link": "https://gcatoolkit.org/individuals/beyond-simple-passwords/",
        "estimatedMinutes": 10,
        "verificationPrompt": "Is two-step verification now on for your main email?",
        "audiences": [],
        "kind": "protect",
        "active": true
      }
    ]
  }
]

Entries

Field
name	The category this entry covers. Uploads match entries by it. See special entries
category	The categories it applies to
thinkific	GCA Academy course links
toolkit	GCA Cybersecurity Toolkit links
toolkitByAudience	Toolkit links per audience. A learner sees their audience's list when there is one, and toolkit otherwise
cyberflex, act	CyberFlex and ACT links
guidance	Short pieces of advice, shown with the links
note	Notes for editors. Not shown to learners
actions	Roadmap steps, in the order learners see them

When an entry has links of several types, the first of thinkific, toolkit, cyberflex and act is its main link.

Special entries

name	Used when
_defaultConsumer, _defaultYoungAdult, _defaultSenior, _defaultSMB, _defaultNonprofit	The learner has no category below 70% with an entry. General resources for their audience
_knowledgeDefault	The audience's default entry is missing too

Actions

Field
id	The step's permanent identifier. Changing it makes a new step
title	Required
instruction	What to do, in a sentence or two
link	An https link to the resource for this step
linkByAudience	A different link per audience, used in place of link
estimatedMinutes	How long it takes. 0 or omitted means unknown
verificationPrompt	The question a learner answers to mark the step done
audiences	Who the step applies to. Empty means everyone
kind	protect (a one-time setup), practice (a habit), learn (a course or reading), process (an organizational control) or recover (only once something has happened)
active	Must be true for the step to reach learners

An upload is refused, naming the entry and action, if:

• an entry has no links, guidance or actions at all, or two entries share a name;
• an action is missing its id or title, or two actions in an entry share an id;
• an action has an unknown kind or audience, a negative estimatedMinutes, or a link that isn't https.