Introduction
Custom Framework Builder is an agent in the X-Analytics AI Toolbox that turns your own framework into a working part of your cyber risk profile. Upload the file, name it, and describe it. The agent reads the domains, questions, and answer keys, builds them out, and places the finished framework in Profile Settings ready to collect responses.
Key takeaways
- Upload your own framework as a spreadsheet, on one tab or several, and the agent builds it into X-Analytics.
- Answer keys carry over. Free-form dollar amounts, maturity scales, and zero to five ranges are all supported.
- Map your controls to an existing framework such as CIS CSC 8.1 by naming the mapping in a column of your upload.
- The agent asks you questions wherever the file is unclear, and you review the built framework before anything reaches production.
- Fill the framework two ways once it is live: auto-fill, an AI-guided pass through the questions, or configure manually.
- The X-Analytics AI Governance Framework, 118 questions across four domains, is available from your customer success team.
Bob Vescio, Chief Innovation Officer of X-Analytics, builds a custom AI governance framework from upload to finalized, then walks through filling it in and editing its mappings.
What is the Custom Framework Builder agent?
Custom Framework Builder is an agent in the X-Analytics AI Toolbox that brings your own framework into X-Analytics as a first-class part of your cyber risk profile. It reads the framework file you upload, interprets its structure, and builds it into the product.
The framework can be one you created, one that is proprietary to your business, or one X-Analytics built for you. Once it is live it sits in Profile Settings alongside every other framework on your account.
How do you add a custom framework?
- Open the agent. Go to AI Tools and type custom. Custom Framework Builder is the only framework-building agent there.
- Select Create Framework. The agent asks for three things: the file, a name, and a description.
- Upload and describe. The name and description you give here are what appear in Profile Settings under Frameworks, so write a description that reads clearly to the next person who opens it.
- The agent builds. It reads every tab, identifies the domains and questions, and interprets each answer key. Larger frameworks take longer. Wherever the file is unclear or a gap appears, the agent asks you about it before anything reaches your production environment.
- Review what it built. The agent reports the domains, the question count, and how it read each answer key.
- Finalize. Select "Yes, finalize the framework". If something needs changing, tell the agent before you finalize rather than after.
- Start collecting responses. The framework drops into Profile Settings under Frameworks, carrying the name and description you gave it.
What kinds of frameworks does the builder support?
| Element | What the builder handles |
|---|---|
| Layout | One tab or several. A multi-tab workbook and a single-sheet framework are both fine. |
| Answer keys | Free-form entry such as a dollar amount, maturity scales, and zero to five ranges. Mixed answer key types across one framework are supported. |
| Mappings | Name a target control in a column of your upload, such as CIS CSC 8.1, and the builder maps to it. |
| Domains and questions | Read directly from the file. |
The more you define in the file you upload, the smoother the build. A framework with its answer keys and mappings already specified needs fewer questions answered along the way.
How do you fill in a custom framework?
Two paths, both from Profile Settings once the framework is live.
| Auto-fill | Configure manually | |
|---|---|---|
| How it works | An AI-guided pass through each question | You open the framework and answer directly |
| Best for | A first full set of responses, fast | Precision on questions where you hold the detail |
| What you see | Guided prompts | The dropdowns, scales, and free-form fields from your upload, exactly as specified |
Manual configuration carries your upload through faithfully. Dropdowns appear as dropdowns, zero to five questions appear on a zero to five scale, and free-form fields stay free-form.
Can mappings be changed after the framework is live?
Yes. Mappings are tunable at any point, not fixed at upload. Go to Settings, then Account Settings, then Frameworks. Select the edit icon next to your framework, then the settings gear. From there you can add or remove mappings for each control and sub-control in the framework.
The X-Analytics team can work through the mapping exercise with you as super admins. Reach out to your customer success team and they will set it up.
Can I use the X-Analytics AI Governance Framework?
Yes. X-Analytics maintains an AI Governance Framework built to capture the risk an organization carries through its AI use cases. It holds 118 questions across four domains, covering your AI use cases and what is at risk in each, governance questions on a zero to five scale, and countermeasure questions on the same scale. Reach out to your customer success team at customersuccess@x-analytics.com to have it added to your account.
It pairs with the Effects of AI Adoption agent, which lowers your NIST CSF and CIS CSC scores where AI adoption widens what your controls cover. Documenting your AI governance program is how those scores return.
What do you walk away with?
- Your framework, inside X-Analytics. Built out with its domains, questions, and answer keys intact, sitting in Profile Settings with everything else.
- A framework that maps to what you already run. Controls tied to CIS CSC or another framework, adjustable at any time.
- Responses you can start collecting. Auto-filled or answered by hand, feeding the same cyber risk profile as the rest of your data.
Where does this agent live?
Custom Framework Builder sits with the other profile agents under AI Tools inside Profile Settings, alongside CIS CSC Upload, NIST CSF Upload, and Profile Integrity Check. The full library is covered in the AI Toolbox walkthrough.
Related walkthroughs worth watching alongside this one:
- Turn any cyber maturity report into your NIST CSF 2.0 profile, for bringing an existing assessment in rather than a framework.
- Effects of AI Adoption, the agent your AI governance framework answers to.
- Activities Log, to see every change made to your profile after the framework goes live.
What X-Analytics is
X-Analytics helps cybersecurity and risk leaders walk into every cyber and AI decision with answers in hand: measurable risk-reducing opportunities, delivered in minutes. X-Analytics is the cyber risk intelligence solution that CISOs, executives, boards, and the risk management industry rely on to align cybersecurity and AI strategy with the business priorities that matter most.
Frequently asked questions
What is the X-Analytics Custom Framework Builder? It is an agent in the X-Analytics AI Toolbox that builds your own framework into X-Analytics. You upload the framework file with a name and a description, and the agent interprets its domains, questions, and answer keys and places the finished framework in Profile Settings.
What file do I upload? Your framework as a spreadsheet. It can span several tabs or sit on one. The agent reads the structure either way.
What answer key types are supported? Free-form entry such as a dollar amount, maturity scales, and zero to five ranges. A single framework can mix them.
Can I map my custom framework to CIS CSC or NIST CSF? Yes. Name the target control in a column of your upload, such as CIS CSC 8.1, and the builder maps to it. Mappings can also be added or removed after the framework is live.
How long does the build take? A few minutes. Larger frameworks take longer, and the agent works through every tab before returning the result for review.
What happens if my file has gaps? The agent asks you about them. Questions, gaps, and anything unclear in the upload come back to you before the framework reaches your production environment.
How do I fill in the framework once it is built? Two ways. Auto-fill runs an AI-guided pass through each question. Configure manually opens the framework so you answer directly, with the dropdowns and scales from your upload carried through.
Can mappings be changed after the framework is live? Yes. Go to Settings, then Account Settings, then Frameworks, select the edit icon and then the settings gear to add or remove mappings for any control or sub-control. The X-Analytics team can work through it with you.
Does X-Analytics have a prebuilt AI governance framework? Yes. The X-Analytics AI Governance Framework holds 118 questions across four domains and captures the risk an organization carries through its AI use cases. Ask your customer success team to add it to your account.
Is X-Analytics a CRQ tool? No. X-Analytics is a cyber risk intelligence solution. Cyber risk intelligence includes CRQ components, and X-Analytics carries them through to the decision: it measures your cyber risk and connects it to the actions that reduce it, through specialized AI agents like the Custom Framework Builder.
Watch the full walkthrough
The video above builds the X-Analytics AI Governance Framework from upload through review and finalization, then walks through filling it in manually and editing its mappings from Account Settings.
Questions about the agent? Reach out to your X-Analytics customer success team at customersuccess@x-analytics.com.
© 2026 X-Analytics. All rights reserved.