Assessment Wizard — User Guide

Purpose

Each supported framework (SOC 2, CIS Controls v8.1, NIST AI RMF 1.0, NIST CSF 2.0) lives under Governance → Frameworks. The hub lists every assessment your organization has created and a New Assessment button.

What to do

• Navigate to Governance → SOC 2 / CIS / NIST AI RMF / NIST CSF.
• Click New Assessment, give it a name and an optional scope summary, then Save.
• Click into the new row to launch the canonical Wizard.

Purpose

The Wizard renders one tab per catalog group. Each row carries a status picker (text or numeric, framework-dependent), an Applicable toggle, an evidence notes box, and — for AI RMF / NIST CSF — a Target value cell.

What to do

• Toggle Applicable off for items that do not apply; capture the N/A reason in the notes.
• Pick a status / implementation level from the dropdown.
• Enter free-text evidence notes (auto-saved on blur).
• Set a Target value if the framework supports one (AI RMF, NIST CSF).

Purpose

When the same control is mapped across frameworks, you don't have to re-score it. The Borrow button finds the most-recent matching response in any other framework's assessment, snaps the 0-100 score to the closest option in this framework, and offers it for one-click apply.

What to do

• Click the Borrow button on any item row.
• Review the suggested score (each candidate shows the source framework, item code, and snapped target option).
• Approved assessments are sorted to the top.
• Click Apply suggestion. The provenance (source framework + item + score + timestamp + user) is persisted so auditors can trace the borrow.
• Use Clear provenance to revert the linkage if you later score the item manually.

Purpose

Per-item evidence files complement free-text notes. Uploads land in a private, RLS-scoped bucket and are downloadable via short-lived signed URLs. The evidence panel accepts multi-file selection, drag-and-drop onto the dashed dropzone, and clipboard paste (e.g., screenshots captured with your OS print-screen shortcut).

What to do

• Click the Evidence button on an item row.
• Drag one or more PDF / DOCX / image files (max 25 MB each) into the dashed dropzone, pick them via the file chooser, or paste an image straight from the clipboard.
• Files are listed with uploader, size, and SHA-256 hash.
• Use the download icon for a signed URL, or the trash icon to delete (audited).

Purpose

The Crosswalk button shows every other framework this item maps to, sourced from the canonical crosswalk tables (NIST CSF, CIS, SOC 2, NIST AI RMF, EU AI Act).

What to do

• Click the Crosswalk button on an item row.
• Mappings are grouped by target framework with badges for the target control IDs.
• Use this to confirm coverage before borrowing or scoring.

Purpose

If you already maintain scores in a spreadsheet, the Bulk Import dialog accepts a 2-column CSV (item_code,value) and upserts in a single transaction. Headers and BOM are tolerated.

What to do

• Click Bulk Import (top toolbar).
• Paste or upload a CSV with columns item_code,value (and optional evidence_notes).
• Review the preview pane for parse errors before applying.
• Confirm to commit; the upsert emits a BULK_IMPORTED audit row.

Purpose

Snapshots persist the full response payload at a moment in time. Use them as quarterly milestones for trend analysis and audit evidence.

What to do

• Click Snapshot in the Snapshots panel to capture the current state.
• Click Delta in the top toolbar to open the Delta Report.
• Select any two snapshots to see per-item diffs (added, removed, changed) plus a summary delta.
• Export the delta as DOCX for board / audit packages.

Purpose

Every assessment moves through Draft → Submitted → Approved → Archived. Submitted+ status locks scoring; only an OrgAdmin can approve or archive.

What to do

• Use the Lifecycle bar (top of the Wizard) to advance the assessment.
• Draft → Submitted: locks scoring, opens review.
• Submitted → Approved (OrgAdmin only): records reviewer and timestamp.
• Approved → Archived: preserves history; can be reopened if needed.

Purpose

All export actions are consolidated under a single Export dropdown in the Wizard toolbar. Every export emits its own audit row (DOCX → EXPORTED, CSV → CSV_EXPORTED, snapshot pack → SNAPSHOT_EXPORTED) with the assessment name and current score percentage.

What to do

• Click Export in the top toolbar to open the dropdown (or press e for the default DOCX export).
• Pick DOCX for a branded, title-page report with per-group tables and an evidence appendix.
• Pick CSV for a flat item_code,value,evidence_notes file suitable for spreadsheet pivots.
• Pick Snapshot Pack for a DOCX bundling the most recent snapshot plus the current responses.
• Filenames follow RhindonCyber_<framework>-Assessment_<slug>_<stamp>.<ext>.

Purpose

The cross-framework Coverage report aggregates every active assessment in your org, surfacing answered / in-scope ratios and weighted score per framework.

What to do

• Navigate to Reports → Assessment Coverage.
• Review the per-framework KPI cards and the rolled-up score percentage.
• Export the rollup as a CSV (60-min throttled view audit + EXPORTED audit on download).

Purpose

Each item row has a selection checkbox. When one or more are checked, a sticky Bulk Actions bar appears above the active group with one-click Set status, Mark Applicable, Mark N/A, and Select group / Clear group. Bulk edits route through the same canonical upsert path as single-row edits, so audit emission is identical.

What to do

• Tick the checkbox next to each row you want to change (or click Select group).
• Pick a status from the Bulk Actions dropdown — every selected row is upserted in sequence.
• Use Applicable or N/A to flip the applicable flag for the whole selection.
• Click the X icon (or Clear group) to dismiss the selection.

Purpose

When two or more snapshots exist, a 1-line sparkline appears next to the score percentage in the header. It charts scorePct across the last eight snapshots so you can see direction-of-travel at a glance. Hover any point for the exact date and score; the green/red delta to the right shows the change from the oldest plotted point to the latest.

What to do

• Capture at least two snapshots from the Snapshots panel.
• Reload the Wizard — the sparkline appears next to the score percentage.
• Hover any point for the captured date and exact score.

Purpose

Press ? anywhere inside the Wizard to open the shortcut help dialog. Shortcuts respect typing context, so they never fire while you're editing notes or numeric fields.

What to do

• ? — open the keyboard shortcut help dialog.
• g / G — jump to the previous / next catalog group tab.
• u — toggle the Unanswered-only filter.
• e — trigger the DOCX export.
• Esc — close any open dialog.

Purpose

When you trigger Submit, Approve, Reject, Reopen, or Archive, the confirmation dialog shows the change in score percentage, answered items, and N/A count since the most recent snapshot — so reviewers see at a glance whether the assessment moved forward, backward, or stayed flat. When no prior snapshot exists, the dialog notes that this transition will establish the baseline.

What to do

• Open the Wizard and click any lifecycle button (Submit / Approve / etc.).
• Review the green / red delta strip above the reason textarea.
• Type a reason (required for Reject and Archive) and click Confirm.
• Capture a fresh snapshot first if you want the next reviewer to see your edits relative to your work.

Purpose

Catalog groups with 60+ items render through a virtualized list. Only the rows visible in the viewport are mounted, so frameworks like NIST CSF 2.0 stay snappy on modest hardware. Behavior is otherwise identical to the un-virtualized list.

What to do

• Navigate any large catalog group — virtualization activates automatically above the threshold.
• Scroll inside the group panel; new rows mount as they enter the viewport.
• All other features (bulk select, evidence files, score borrow) continue to work unchanged.

Purpose

The cross-framework Assessment Coverage report (Reports → Assessment Coverage) renders one RC_HEADER row per supported framework. Each row exposes a drill-through action that opens the Assessment Wizard pre-filtered to that framework, so reviewers can jump from a low coverage score straight into the underlying assessment without re-navigating the menu tree.

What to do

• Open Reports → Assessment Coverage.
• On any framework row, click the Open in Wizard action in the right-aligned action column.
• The Wizard launches scoped to that framework's most recent active assessment, with the group tab and unanswered-only filter preserved across the deep-link.
• Use the back button (or breadcrumb) to return to the Coverage report.

Purpose

ISO 42001 Annex A (38 controls across 9 groups) and the EU AI Act (42 requirements across 6 risk-tier groups) both render on the same canonical Wizard shell as SOC 2 / CIS / NIST. Approved wizard responses are mirrored one-way into the existing per-org status registers (`compliance_org_status` for both frameworks) by a database trigger, so the bespoke /reports/iso-42001-annex-a and /governance/eu-ai-act report pages stay live and in sync — no double-entry. Both frameworks inherit the full canonical toolset: lifecycle, snapshots, delta reports, evidence files, bulk CSV import, score borrowing, cross-framework coverage, hotkeys, and virtualization.

What to do

• Open Governance → ISO 42001 → Assessments or Governance → EU AI Act → Assessments.
• Click New Assessment, then click the row to launch the canonical Wizard.
• Score every in-scope item using the framework's status palette (ISO uses Not Implemented / Partially / Implemented / N/A; EU adds Informational and Systemic-Risk-Only as neutral states excluded from pctFull math).
• Move the assessment to Approved — the underlying status register is updated automatically and the existing report pages re-render with your new values.
• Use the Open in Wizard buttons surfaced on /reports/iso-42001-annex-a and /governance/eu-ai-act to deep-link back the other direction.

Purpose

Three small but high-value polish items shipped in v1.4. (1) A denominator-hint chip in the Wizard header makes it explicit that un-scored rows are excluded from the percent-complete denominator — they are NOT silently counted as gaps. This matters most on EU AI Act where the `not_assessed` neutral state intentionally drops the denominator. (2) ISO 42001 SoA exports (DOCX + XLSX) now borrow the platform-suggested baseline justification verbatim for any row the org has not yet edited, and tag the source so external auditors can see the org has accepted the platform statement as-is. As soon as the org edits `notes`, the org text wins and the tag is dropped. (3) The AIMS KPI dashboard now surfaces the most recent ISO 42001 Wizard snapshot alongside the existing four tiles, so the AIMS dashboard reflects Wizard-driven score changes without re-running any KPI math.

What to do

• Open any framework wizard — the header now shows an `N/M scored` chip next to the score percentage. Hover for the denominator explanation tooltip.
• On /reports/iso-42001-soa, export to DOCX or XLSX — rows you have not personally edited will use the platform-suggested baseline language with a clearly tagged source line.
• On /governance/aims-scope or /reports/iso-42001-annex-a (AIMS KPI tab), the most recent ISO 42001 Wizard snapshot is now reflected in the KPI strip.