You can run an ISO 27001 information security management system in spreadsheets for a small scope. Use tabs for scope, assets, risks, the Statement of Applicability, actions, audits and evidence. It strains when many people edit, evidence must be refreshed constantly or you manage several frameworks. Those are the moments to automate.
A caution on sources
ISO sells the standard and we could not fetch its text, so this guide sticks to the structure widely described: management system clauses 4 to 10 covering context, leadership, planning, support, operation, performance evaluation and improvement, plus Annex A in the 2022 edition with 93 controls in four themes (organizational, people, physical and technological). Certification is granted by an accredited certification body after an audit, not by you. Check clause wording in the licensed standard.
The workbook, tab by tab
1. Scope and context. Scope statement, locations, systems, interested parties and their requirements, plus exclusions with reasons.
2. Asset and owner register. Information assets and supporting systems with owner, classification and location.
3. Risk register. Risk, asset, threat, vulnerability, likelihood, impact, score, owner and treatment decision. Put the scoring method on its own tab so the scale is documented.
4. Statement of Applicability. One row per Annex A control: included or excluded, reason, implementation status, linked policy or procedure, owner and evidence link. The SoA ties your risk treatment to controls, so keep it consistent with the risk register.
5. Risk treatment plan. Actions, owners, due dates and residual risk acceptance by management.
6. Objectives and metrics. Security objectives with how you will measure them and the results each period.
7. Documents and policies. Register of documents with version, owner, approval date and next review.
8. Competence and awareness. Training and acknowledgment records.
9. Internal audit and management review. Audit schedule, findings, nonconformities, corrective actions and management review notes.
10. Evidence index. For each control, a pointer to where proof lives and the date it was last refreshed.
Where spreadsheets hold up
One scope with a modest control set, a team of a few people who already talk daily, and an auditor who accepts exports and shared folders. Version history in your document store gives you a reasonable audit trail. Conditional formatting for overdue dates and a monthly review meeting carry a lot of weight.
Where they strain
- Two people edit the same sheet and overwrite each other.
- Evidence links rot, and nobody notices until the audit.
- The SoA says a control is implemented, but nothing checks the system setting still holds.
- Risk scores are stale because updating them is manual.
- A second framework, such as SOC 2 or a privacy standard, doubles the sheets and creates inconsistent answers to the same question.
- Corrective actions live in email and spreadsheets and never close.
- Technical controls such as vulnerability management or change control need data from many systems that nobody exports on schedule.
Signs it is time to automate
You spend more hours updating the workbook than improving controls. You cannot say in a minute which controls lack current evidence. A customer asks for a mapping to another framework and it takes days. Audit prep becomes a scramble. Turnover means only one person understands the formulas.
What to do
- Build the ten tabs with locked formulas and a named owner per tab.
- Define the risk scoring scale before filling the register.
- Keep the SoA and risk register in step: every risk treatment points to controls.
- Add an evidence refresh date for each control and review the oldest monthly.
- Run an internal audit on a sample of controls and log findings as actions.
- Hold management review on a calendar and file minutes.
- Track time spent on admin; plan automation once it crosses a threshold you set.
Quick check
Do auditors accept spreadsheets?
Nothing in the material we reviewed prohibits them. Certification bodies assess whether the management system works and is documented, not the tool.
Can I exclude Annex A controls?
You can mark a control as not applicable in the SoA with a justification tied to your risk assessment.
How Safeguard helps automate this
When the workbook becomes the bottleneck, the missing piece is live evidence. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot, and monitoring runs continuously between audits, saving the team time for other work. Technical evidence comes from your real code and dependencies: scans, SBOMs and reachability, which support vulnerability and secure development controls. Autonomous remediation can open tested fix pull requests; it is off by default, every category starts on Manual, and you choose which categories run automatically and the approval level. An accredited certification body performs the audit; Safeguard does not certify you.
Open the framework mapping demo or book a call.
Sources
- ISO/IEC 27001 standard page: the standard is paywalled and the page blocked our fetch, so clause and control counts are stated generally. Verify against the licensed text.
Last reviewed: 18 October 2026.
