My first version was quite bad. I need to ask the questions in a consistent manner, re-phrase the language and get all necessary aspects (for example I had not asked what industry the person works in). I am looking around for web based questionaaire software, of which there are mainly commercial solutions. I did find the Socrates Questionnaire Engine but it is Java and unpleasant. I am going to ask the department if I can use their Perceptions software.
UPDATE 12:14PM - Socrates and Perceptions are too complicated. PHP keep things nice and simple. Keep checking back at http://singe.rucus.net/quest/ to see my progress.

I then stumbled across an interesting article on how to deal with worms. It had some usefull methadology descriptions. I felt the most interesting paragraph to be:

"  There are six steps involved in a worm mitigation methodology, in order: preparation, identification, classification, trace back, reaction, and post-mortem. The reaction phase can broken down into containment, inoculation, quarantine, and treatment. Worm mitigation requires coordination between system administration, network engineering, and security operations personnel. This is critical in responding effectively to a worm incident. The containment phase involves the limiting of the spread of a worm infection to those areas of the network already affected. With the worm infection contained, or at the least, significantly slowed down, the inoculation process further deprives the worm of any available targets."