October 2026 release: assessments in Excel, duplicating for the new year, a new assessment list

With the October release you can take assessments to Excel and read them back in. One click turns an assessment into the starting point for next year, and the list of assessments shows at a glance how far each one has come.

Edit assessments in Excel and read them back in

Some teams prefer to fill in an assessment in Excel, together in a workshop or spread across several specialists. This now works in both directions.

"Assessment as Excel" downloads the current state as .xlsx. The questions are grouped by area with current value, target, justification and document link, and with measures unlocked also the measures and validations. Depending on the module, there is a sheet for the risk assessment and one for the rows. You pick values from lists showing the wording of your scale, such as "2 - Partially". Next to your own target, the file shows the applicable target, the value that actually applies from the area, the assessment or the scale.

"Import" reads the file back in, as a new assessment or over an existing one. Before overwriting, SCMC lists every change from the old to the new value and writes only once you confirm. An empty cell changes nothing, a value is removed only with #DELETE. If the file contains errors, you get a list with sheet, row and column, also as Excel if you wish, and nothing is written. The import takes over responsible persons only if they are already members of the project.

Into the new year: duplicate assessments

"Duplicate" creates a new assessment of the same module with all current answers, measures, risks and rows. You choose the year and the comment yourself, the history stays with the original assessment.

The year can also be chosen when you create a new assessment, for example in December for the coming year. The annual quota applies to the chosen year.

When you create an assessment, you also choose its category, preset with your project's category. The comment is required, because it tells the assessments apart in the list. SCMC proposes it from module, year and category, for example "IKT - 2026 - Category B", and "Copy of assessment 2025" when duplicating. You can change it at any time.

Large assessments are duplicated or imported in the background. The card keeps showing how many values have been taken over, and the assessment can be opened as soon as everything is there.

The list of assessments

Every assessment appears as a wide card with year, comment and category. Two bars show how much is answered and how far the target is met. The documents sit right on the card: answers, measures and risks as Word, and the assessment as Excel. When someone in the project changes an assessment, the card updates by itself. The newest years are at the top, and within a year the assessment changed last.

The results view is tidier in turn. It now holds the PDF report and the comparison with other assessments.

Risk analysis in Word

The risk analysis is available as an editable Word document, in the risk results and on the card of the assessment. It opens with a risk matrix and a residual risk matrix, followed by every assessed position in descending order of risk, each with its measure. At the end come the positions that have not been assessed yet. Measures and the risk analysis are part of every module. Only for the Cyber-Security Basis Check are they available once measures are unlocked for the module.

Help, videos and a learning module

In the menu, "Knowledge" now groups help, blog and news. The help center is organised by topic and has a search, with new entries on Excel, on creating assessments and on data protection and security.

A new short video shows in just over two minutes how to fill in an ISO 27001 assessment: answers and targets per area, measures with deadline and responsible person, then the risk results. It is in German.

There is also the self-learning module "SCMC Cyber risks: leadership required". In about 50 minutes and without any technical background, it shows executive boards why information security is a leadership task and how to make their company's maturity visible. It was created with Heinz Stieger and the HWZ University of Applied Sciences in Business Administration Zurich for the CAS General Management and is in German. You reach the video and the module at the top of the help center.

A website without Google, the newsletter in your profile

The SCMC website works without any Google service and therefore no longer needs a cookie banner. Visitor statistics come without cookies from our own access logs in Zurich, and we protect the contact form against spam without reCAPTCHA.

From time to time we send a newsletter about what is new. Whether you receive it is set in your profile, and every newsletter carries a link to unsubscribe. Notices about your contract reach you in any case.

Smaller improvements

In the measures and in the risk assessment, a click on the code of a question or the number of a row leads straight to its answer.
For modules with sub-areas, the total in the results used to show too little, because the questions of sub-areas counted twice towards the maximum. This is fixed. The values are recalculated the next time the results are opened, your answers stay as they are.
Dates follow the language of the page, whatever the language setting of your browser.
An open assessment shows its year at the top, next to the module.
Next to the field for responsibles, a note explains that invited people can be chosen once they have accepted their invitation.
The access logs of our website are kept in Zurich, and sign-in data appears in no log. The privacy policy now describes exactly what is processed outside Switzerland.