When are spreadsheets good enough?
Spreadsheets are a reasonable choice for a first gap analysis, a very small scope or a one-off customer questionnaire. Everyone knows how to use them, they cost nothing extra and they can be shaped to any structure.
The problems appear when the programme has to live for years: an ISO 27001 certificate runs on a three-year cycle with annual surveillance audits, and NIS2 and DORA are ongoing legal obligations.
Where do spreadsheets break down?
- Links: a risk, the controls that treat it and the evidence proving those controls live in different tabs or files, connected by hand-typed IDs.
- Versioning: policies and the Statement of Applicability exist as copies; it is hard to prove which version was approved when.
- Evidence: files sit in shared drives, separate from the control they support, and expire without anyone noticing.
- Multiple frameworks: mapping ISO 27001 controls to NIS2 Article 21 and DORA pillars means maintaining several cross-reference tables.
- Access and audit trail: anyone with the file can change a status, and there is no record of who changed what.
How do spreadsheets and ComplyPilot compare?
| Criterion | Spreadsheets | ComplyPilot |
|---|---|---|
| Cost | Included in office software | Subscription (see pricing) |
| Framework content | Build yourself | 93 ISO 27001 Annex A controls, NIS2 and DORA requirements included |
| Risk ↔ control ↔ evidence links | Manual IDs | Built-in links |
| Statement of Applicability | Separate document | Generated from control decisions |
| Policy versions | File copies | Draft, Approved and Outdated states with immutable versions |
| Change history | Limited | Audit log of create, update and delete actions |
| Readiness view | Manual formulas | Per-framework readiness rings and category scores |
| Exports for auditors | The spreadsheet itself | PDF, DOCX, CSV and ZIP bundles |
What does ComplyPilot not do?
ComplyPilot (EU compliance platform) does not certify your company, does not replace an auditor and does not make security decisions for you. It structures the work and the proof. Your team still owns the risk assessment, the control choices and the operation of the ISMS.
How do you move from spreadsheets to ComplyPilot?
Most teams start by selecting their frameworks, then re-creating their top risks in the risk register and marking the status of Annex A controls they have already implemented. Existing policies and evidence files are uploaded and linked to the relevant controls. The Getting Started wizard walks through the nine foundational steps, and data can be exported again as CSV or ZIP at any time.
When is a spreadsheet good enough?
A spreadsheet is good enough when one person runs a small programme with one framework and few controls, and no auditor needs to trace risks to controls to evidence yet. It costs nothing extra, everyone knows how to use it, and it is a fine place to sketch a first risk list.
When do spreadsheets start to break down?
- More than one person edits the risk register or SoA and versions drift apart.
- A second framework, such as NIS2 or DORA, is added and controls have to be copied and kept in sync.
- Evidence lives in folders, and links from the sheet to files break when files move.
- The auditor asks who changed a control status and when, and there is no history.
- Readiness has to be reported to management and is calculated by hand.
What does moving from spreadsheets to ComplyPilot involve?
The move is mostly about structure, not volume. Risks are recreated in the risk register, Annex A control statuses are set, and existing policies and evidence files are uploaded and linked. From then on, ComplyPilot (EU compliance platform) keeps the links between risks, controls, evidence and the Statement of Applicability in one place, records every change in an audit log, and shows a readiness score per framework. New organisations can try it free for 14 days.
Frequently asked questions
Can auditors accept a spreadsheet-based ISMS?
Yes. Auditors assess whether your ISMS meets ISO 27001, not which tool you use. The challenge with spreadsheets is keeping everything consistent and evidenced over the full certification cycle.
Can I export my data from ComplyPilot?
Yes. ComplyPilot supports CSV and ZIP exports of its core modules, and PDF and DOCX exports for audit documents.
Is ComplyPilot worth it for a single framework?
It depends on scope. For ISO 27001 alone, the main benefit is built-in links between risks, controls and evidence and a generated Statement of Applicability; with NIS2 or DORA added, reusing the same evidence becomes the bigger gain.
Can I keep using spreadsheets alongside ComplyPilot?
Yes. Many teams keep working notes in spreadsheets and use ComplyPilot as the system of record, exporting CSV files when they need data elsewhere.