Frequently Asked Questions

SCMC reduces the effort involved in coordination, follow-up, and repeatedly gathering information that already exists. Instead of spreading responses, evidence, and responsibilities across emails, Excel files, and documents, everything is managed centrally in one structured workspace.

Excel works up to a point. Once multiple stakeholders, recurring assessments, or several parallel projects are involved, version chaos and limited traceability quickly become a problem. SCMC provides a shared, structured environment built for exactly these use cases.

Responses, evidence, and project statuses are documented in a structured and consistent way. This makes it easier to track decisions, maintain supporting documentation, and prepare information for internal or external audits.

SCMC gives everyone involved a shared foundation. Responsibilities, contributions, and progress are clearly visible, which makes coordination easier and communication more consistent across teams and stakeholders.

SCMC is designed to be intuitive to use. Most teams can get started quickly, and we also offer short introductions or structured onboarding where needed.

SCMC helps consulting firms manage multiple client engagements in a structured and consistent way. This reduces manual effort, improves delivery quality, and makes projects easier to scale.

Yes. Smaller organizations benefit in particular from being able to build a professional and reusable way of working without adding unnecessary complexity or administrative overhead.

The value increases with every additional use. The more assessments, responses, evidence, and comparison points you have in the platform, the easier future reviews, follow-up projects, and recurring evaluations become.

Previously created content remains available within the project and can be reused or compared later. This means knowledge is retained and becomes more valuable over time.

Click the button in the invitation email. If you do not have an account yet, you go straight to the sign-up. Use the email address the invitation was sent to, otherwise the invitation is not linked to your account. After confirming your email address you find the project in your project list. If you already have an account, sign in and you go straight to the project. You can still use the link in the invitation later.

Yes. Multiple users can collaborate within the same project, making cross-functional work easier and reducing coordination through email and Excel.

There is no limit to the number of projects you can create. You can set up as many projects as needed.

You can have multiple passkeys, but only one per device. If you try to add a second passkey for the same device, nothing may happen. This is a known issue in some browsers.

No, your registration is not lost. Open the confirmation email we sent you and click its link to reach the activation page. Confirmation codes are valid for 24 hours; if yours has expired, request a new code on that page and then enter it to finish. You do not need to register again.

In the project list, the owner of a project sees the “Delete” button. This deletes the project and its assessments, the members lose access, and a running card subscription is ended. While an invoice of the project is open, a renewal invoice included, deletion is blocked, and once it is paid, deletion is possible. Issued invoices are retained and are not deleted with the project.

In “Profile” with “Delete User”. Your own projects are deleted and their subscriptions end immediately, and you are removed from other people's projects. While an invoice for one of your own projects is open, the deletion is refused, because open invoices have to be paid in any case. Pay the invoice, or first transfer the owner role of the projects concerned to another member. Invoices are kept for ten years as required by law.

As the owner, open the “Members” tab in the project and click “Promote to Owner” for the member you choose. That member needs an account, a pending invitation cannot be promoted. A project has exactly one owner, and you become an admin in the process. As the owner you cannot leave a project, so transfer the role first.

The number of seats follows from the booked packages, and the “Details” tab shows it under “Members Limit”. Every member takes a seat, the owner and pending invitations included. While seats are free, owners and admins invite further people via “Add Member”. More seats come with the additional user packages (+1 and +5) under “Switch Package”, the only packages that can be bought more than once; a module is bought once.

You can create two assessments per module and year. They count against the year you choose when you create them, so in December you can already create one for the coming year.

Yes. You can compare any two answer sets for the same questions within the same project.

Click “New” on the module card, or “New assessment” at the top of the list of assessments. In the window you choose the year, the category and a comment. The year decides which year's quota the assessment counts against and cannot be changed later; you can choose next year, this year and the five years before. The category is preset with your project's category. A category pre-fills the new assessment with the defaults of its template, which you can then change freely. The comment is required, because it tells the assessments apart in the list. SCMC proposes it from module, year and category, for example “IKT - 2026 - Category B”, and adjusts the proposal as long as you have not typed anything yourself. After “Create” the new assessment opens.

The newest years come first, for example 2027 before 2026. Within a year, the assessment changed last comes first. When someone in the project changes an assessment, its card moves up. Every card shows its year, and an open assessment shows it at the top next to the module.

In the list of assessments of a module, every assessment has a “Duplicate” button. Choose the year and a comment; this year and “Copy of assessment” with the year of the original are suggested. The comment is required, it tells the assessment apart in the list. The new assessment takes the category of the original. The new assessment receives all current data: answers, points that do not apply, targets, measures and risks, including those currently hidden, and the rows of dynamic areas. Reminders and the history are not taken along. Like any new assessment it counts against the quota of the chosen year. It is filled in the background, the list shows “Being duplicated …”, and it can be opened once it is done. If the duplication stops, the list names the reason, and “Try again” continues where it stopped. Everyone with write access in the project may duplicate an assessment.

In the “Measures” tab, every measures card has the fields “Measure Deadline” and “Responsible for Measure”. The validation has its own deadline and its own responsible persons (“Validation Deadline”, “Responsible for Validation”). That way you see at a glance who implements what by when, and who checks it afterwards.

On the measures card, use “Set a reminder” to pick a reminder time in the future and choose the recipients. At that time the reminder goes out by email to the chosen people, with a link straight to the measure. Until it is sent, it appears under “My Tasks” for its recipients.

The “My Tasks” tab in the project collects, across all assessments of the project, everything assigned to you: measures and validations you are responsible for, and reminders addressed to you. The list is sorted by deadline, overdue items are marked, and one click takes you straight to the measures card.

For the free Cyber-Security Basic Check, measures and risk assessment are a separate package, “Measures for Cyber-Security Basic Check”. Without it both tabs are locked, the PDF report contains no recommendations, and “Measures as Word” and “Risks as Word” are not available. All other modules include measures and risk assessment. Owners and admins buy the package via “Switch Package” or directly with “Upgrade Now” in the locked tab.

The “Results” tab offers “Download PDF” for the results report. The other documents are in the list of assessments of a module, on the card of the assessment under “Documents”: “Answers (Word)” for all answers, “Measures (Word)”, “Risks (Word)” for the risk analysis and “Assessment as Excel” with the data of the assessment as a spreadsheet. Measures and risks only appear when measures are unlocked for the module. The risk analysis is also in the “Risk Results” tab.

The PDF report sums up the result compactly: the score per area in percent as a table, a spider chart of current versus target, a bar chart per area and the overall score with a short rating. When measures are unlocked, the recommendations for the questions follow per area, together with your answer. It is well suited for passing on, for example to management.

“Answers (Word)” delivers the whole assessment as a .docx: per area every question or row with the current and target value in the wording of your scale, the justification and the document link, with items that are not applicable or still open named as such. “Measures (Word)” lists measures and validations by area, with the recommendation for the question or your text on what will be implemented, plus status, responsible persons, deadlines and both comments. Both documents are editable and give you a framework for your own report.

You find it in the “Risk Results” tab under “Risk analysis as Word” and in the list of assessments, on the card of the assessment under “Risks (Word)”. The document shows a risk matrix and a residual risk matrix, then every assessed position in descending order of risk, with area, current value, probability, impact, residual risk and the related measure. At the end come the positions that have not been assessed yet. The filters of the view do not apply to the document, it always contains all risks.

The Excel file contains the current and target values per area, and depending on the module per question too, for further calculation in your own analyses. With “Compare with others” in the “Results” tab you select several assessments of the same module and download them side by side in one sheet with “Download Excel”. For most modules the button is also in the “Measures” tab.

You find “Assessment as Excel” in the list of assessments of a module, on the card of the assessment under “Documents”. The file holds the current state of the assessment on up to four sheets. “Assessment” names the module, year, comment, category and the target of the assessment, followed by notes on importing. “Questions” is organised by area: every area as a bold row, below it its questions with code and title, current value, target, justification and document link, and where measures are unlocked, measure and validation with responsible persons and deadlines. “Risk assessment” holds probability, impact and the residual values of the positions that can carry a risk. “Rows” exists for modules with dynamic areas and holds every entry with its fields. As in the views, measures and risks of positions that meet their target or are not applicable are left out. Question texts are not in the file, people appear with their email address.

You pick scale values from a list in the cell, such as “1 - No”. A plain number works too, the number in front is what counts. The current value holds a value of the scale, N/A for not applicable, or stays empty while the question is open. There are two target columns. “Own target” is the value set at this place, and it is the only one the import reads. “Applicable target” shows what actually applies: your own, otherwise the one of the area above, otherwise the one of the assessment, otherwise the default of the scale. Columns with a grey header and “(display only)”, that is the applicable target, risk and residual risk, are not read by the import. Modules whose scale has no target, such as the Cyber-Security Basis Check, have no target columns. In an area row, only the own target of the area counts. The first row of every sheet is hidden and holds the keys of the columns. Keep it, otherwise the file can no longer be read in. The order of the columns does not matter.

Click “Import from Excel” at the top of the list of assessments of a module and choose “New assessment”. Once you pick the file, the page suggests year and comment from the file, you can change both. The file must come from the same module. The new assessment counts against the annual quota of the chosen year. If it is used up, the page refuses straight away. The category of the file is taken over if the module knows it. Writing happens in the background: you return to the list, the card shows “Importing …” with the progress, and you can open the assessment as soon as everything is in. If the import stops, the card names the reason, and “Import again” continues with the same file.

Click “Import” on the card of the assessment under “Data”, or choose “Overwrite an existing assessment” on the import page and pick the assessment. After “Check and plan” you see the plan: a list of every change with location, field, previous and new value, filterable by kind (new, changed, deleted, new entry and “removed as a consequence”, such as the measure of a question that becomes not applicable). Only “Apply” writes. If someone changes the assessment between plan and apply, SCMC refuses and asks for a new plan, so that only what you have seen is written. While the import runs, the assessment is read only. The import does not change the category of an existing assessment.

An empty cell changes nothing, including one you have emptied. To remove a value, write #DELETE into the cell. In the current value, #DELETE resets the answer to open. N/A in the current value marks the question as not applicable, which drops its measure and its risk, and the plan shows this beforehand. A question or entry missing from the file stays as it is. On the “Rows” sheet an entry is defined by area and number: an existing number changes the entry, a new number creates a new entry under exactly that number, with its fields and field codes below. Whole entries are deleted in the app, #DELETE empties a single field. Yes/no fields take Yes or No, date fields dd.mm.yyyy, fields with a fixed choice an item of their list.

Responsible persons appear with their email address in the file. Only people who are members of the project and have activated their account are taken over. An invited person who has not accepted the invitation yet, or an unknown address, results in a note. The measure is still taken over, just without that person. The import invites nobody and sends no emails. Write deadlines as dd.mm.yyyy. Reminders are not imported, because they send emails. Set them in the app. For the Cyber-Security Basis Check, the import takes over measures and risks only if measures are unlocked, otherwise a note gives the number of values left out.

SCMC checks the whole file before anything is written and collects all findings. Errors stop the import and nothing is written, for instance a value outside the scale, an unknown question code, an invalid date or N/A together with a value. Notes let the import go ahead and say what is left out, such as a person who is not a member or an entry in an area row next to the target. Every finding names sheet, row and column as Excel shows them, along with the value and the reason. “Download as Excel” gives you the list as a file to work through next to your assessment. Then correct the file and upload it again.

The most common reasons: the file is not an .xlsx from “Assessment as Excel” or is larger than 4 MB. It comes from another module. It was exported before a change of the file format, in which case SCMC asks you to export again. The annual quota of the chosen year is used up, which only affects a new assessment. The assessment is locked, or an import or a duplication is running on it. Or you only have read access in the project, importing is open to everyone with write access. In all these cases nothing is written.

In the project, open the “Details” tab and click “Edit”. Under “Step 1: choose the payment method” select Invoice, fill in “Step 2: billing address” and save. Then pick the packages via “Switch Package”, and before you buy, the page shows what will be invoiced. Invoicing is available on the yearly subscription only, and members with the Owner or Admin role can buy.

The modules are unlocked as soon as the invoice is issued, so you can start working right away. The paid yearly period only begins once your payment has been booked on our side. If the payment does not arrive, the unlock is withdrawn after the payment term and a grace period.

The Swiss QR invoice is sent by email to the address entered under “Email for Invoices” in the billing address, payable within 14 days. In the project, “Invoices” lists every document with number, date, “Payable by”, amount, status and PDF, and overdue ones are marked. An issued invoice is never altered, a correction becomes a document of its own. If the subscription renews, the invoice for the following year arrives the same way before the period ends.

Only members with the Owner or Admin role. Writers and readers see neither the “Invoices” tab nor the billing address, and SCMC does not send them this data either. The billing address is copied onto the invoice when it is issued, so later changes only apply to new invoices.

Yes, in the “Details” tab under “Step 1: choose the payment method”. The choice applies to the next purchase and the next renewal. While a period that has already been paid is running, the switch is blocked, and the message names the date from which it is possible. If you need it sooner, write to support@scmc.ch. Invoicing is always yearly, even if you previously paid monthly by card.

While an earlier purchase invoice of the project is not fully paid, another purchase on invoice is not possible, and a partial payment does not change that. The purchase page shows this before you click and names the open invoice. Once it is settled, you can buy again. An open renewal invoice does not block a purchase.

Only in Switzerland. We store all projects, assessments, answers and document links in the Amazon Web Services data centres in Zurich, together with the backups, the access logs and the firewall logs. None of it is stored in any other country, Germany included. Outside Switzerland, data only passes through, encrypted: when the website is opened, via the nearest access point, and for the live update that shows a change straight away to others in the same assessment, via AWS in Frankfurt. Both only forward and store nothing.

We do not sell or rent data. Only service providers we need for operation are involved: Amazon Web Services for hosting, storage and sending emails, and Stripe for card payments. Munot of K-I-Soft IT&Holding GmbH analyses the access logs of our website, in Switzerland and without cookies. If you buy on invoice, we issue the invoice ourselves, without a payment provider. The details are in the privacy policy.

Only session cookies for signing in, the platform does not work without them. We set no cookies for analytics or advertising, which is why there is no cookie banner. Our visitor statistics come without cookies from the access logs of our server, and we protect our forms without third-party services.

Signing in happens on a dedicated, secured sign-in page. Instead of a password you can use a passkey, that is signing in with your fingerprint, face recognition or the PIN of your device. You can also switch on two-factor sign-in in your profile. We recommend both, especially for accounts with owner or administrator rights.

Every person in a project has a role. Readers see all assessments and reports but change nothing. With write access you answer questions, record measures and import or duplicate assessments. Administrators also manage the members, the billing address and the invoices. The owner can in addition delete the project and hand over the owner role. Only owners and administrators see the billing address and the invoices.

Yes, throughout. On the way between your browser and SCMC, data is encrypted with TLS. At rest, the database, the backups and files such as invoices are encrypted with SCMC's own key. This key is kept in the AWS Key Management Service in Zurich and does not leave Switzerland.

When the owner deletes a project, its assessments, answers and measures are deleted. When you delete your user account, your personal data is removed. Because of the statutory retention obligation we keep invoices for 10 years, also after deletion. As long as an invoice for one of your projects is open, neither the project nor your account can be deleted. Settle the invoice or hand over the owner role to someone else.

We keep technical logs and security data for 6 months at most: firewall logs for 30 days, website access logs for 60 days, their analysis by Munot for 6 months. They serve operation, troubleshooting and the protection of the platform.

Once downloaded, the file leaves our protection. It holds your answers, justifications and document links and the email addresses of the responsible persons. Treat it as confidentially as the assessment itself, store it only where authorised people have access, and delete copies you no longer need. The same applies to the reports in PDF and Word.