Cye Platform Questionnaire for Private Equity: Overview & How It Works

Overview

The Cye Platform Questionnaire for Private Equity is a structured mechanism for collecting organizational information from subsidiaries/portfolio companies, such as internal security policies, manual processes, and operational practices, that cannot be discovered automatically.

Respondents access and complete the questionnaire in the Cye Platform. Once submitted, Cye's Delivery team receives the responses and evidence for review.

By bridging the gap between automated scanning and human-driven assessment, the questionnaire allows platform owners to:

Execute repeatable, consistent security assessments across multiple portfolios.
Convert external responses into standardized platform entities (findings, technologies, and processes).
Maintain an operational audit trail covering questionnaire distribution, submission, and due-date changes at both parent and subsidiary levels.

Note: The Cye Platform Questionnaire is a distinct feature from the Cost of Breach Questionnaire, which collects financial data inside the platform to estimate breach impact. For financial input, refer to [Inputting Cost of Breach Data].

The Questionnaire Sequential Pipeline

The questionnaire moves through four distinct stages. Each stage is a prerequisite for the next:

Stage	Who	Primary Action
Issuance	Cye Customer Success Team	Send the questionnaire to the relevant portfolio companies, with a due date.
Filling Out	Portfolio Companies	Receive the secure link, answer questions collaboratively, attach evidence, and submit.
Tracking & Oversight	PE Administrators	Track response progress across the portfolio via the Companies Questionnaires dashboard to ensure completion (e.g., "42 of 60 subsidiaries completed").
Review	Cye Delivery	Reviews the submitted answers and evidence to complete the assessment.

How It Works: From Answers to Risk Metrics

The core value of the questionnaire lies in how it transforms structured and free-text answers into standardized platform data after submission:

1. Entity Generation (New and Existing)

When a questionnaire is submitted, the Cye Delivery Team compares the answers against the current organizational inventory. This results in three types of Changes:

Creation: If an answer describes a Finding, Process, or Technology that does not exist in the platform, a new entity is created.
Update: If an answer corresponds to an existing entity, the team updates its fields or changes its status.
Skip: If an answer matches an entity that already exists in the same state, no change is made.

2. Impact on Risk Metrics

Questionnaire-sourced entities participate in platform calculations immediately upon creation:

Exposure: Findings flow into Exposure calculations and the Org Attack Graph.
Maturity: Processes and Technologies populate the security inventory and influence Maturity scoring.
Likelihood: Impacted indirectly via Exposure—new findings and control gaps update attack paths and control posture, which adjust likelihood estimates.
Cost of Breach: Entity creation does not change cost assumptions directly; cost is driven by the Cost of Breach model. However, overall risk (Expected Loss) changes when likelihood shifts due to Exposure/Maturity updates.

How Questionnaire Data Behaves

Following the review of submitted answers and evidence, Cye's delivery team generates corresponding Findings and Assets, and establishes the initial Maturity score for the organization.

Findings and Assets: Cye Services initiates a new engagement dedicated to the questionnaire to house all generated Findings and Assets. Findings populate the Findings page, while Processes and Technologies populate the Assets page. These records retain permanent Cye Platform attribution and cannot be deleted by company administrators.
Maturity Score: Cye's delivery team establishes the baseline Maturity score for the organization derived directly from the questionnaire responses.

Audit Log

The Cye Platform records all questionnaire-related actions within the centralized audit log. Every log entry automatically captures the company name and questionnaire name.

Event-specific metadata is logged according to the administrative level:

Parent-Level Events:

Questionnaire Dispatch: Captures the transmission date.

Portfolio-Company-Level Events:

Questionnaire Submission: Captures the exact submission date.
Due-Date Extension: Captures the original due date, the updated due date, and the submitted justification.

Wrap-Up/Next Steps

The Cye Platform Questionnaire for Private Equity turns critical information that automated scanning cannot reach into trusted, standardized platform data.

Expert Review: Submitted answers and evidence are reviewed by Cye Services and incorporated into your Findings, Processes, and Technologies.
Clear Traceability: Every generated item includes its specific source field, system tag, and a comment linking it directly back to the originating question and answer.

These questionnaire-sourced entities act as first-class inputs, feeding directly into the organization's core risk model.

Next Steps - Completing the Cye Platform Questionnaire for Private Equity: A step-by-step respondent guide for portfolio companies.