Guides › Excel or software?
ISMS in Excel or software? An honest comparison.
Almost every ISMS starts in Excel and Word. That is not a mistake: it is often enough to begin with. But with every asset, every risk and every audit, the maintenance effort grows. This guide shows where the limit lies and how you can tell that you have reached it.
When Excel is perfectly sufficient.
One person, one location
If only one person maintains the ISMS and the company is of a manageable size, spreadsheets make it easy to keep track.
The beginning
For the first inventory, a gap analysis or a quick overview of your systems, a spreadsheet is quickly set up.
No audit in sight
As long as nobody asks for evidence, nobody notices that versions, links and history are missing.
Where Excel reaches its limits.
The differences do not show on day one, but in day-to-day operation and, at the latest, in the audit.
| Requirement | Excel and Word | ISMS software |
|---|---|---|
| Relationships between assets, risks and measures | Manual cross-references that break with every change | Links in both directions, always up to date |
| Risk assessment | Formulas per spreadsheet, easily overwritten by accident | Consistent methodology, calculated and traceable |
| Statement of Applicability | A separate spreadsheet that has to be updated by hand | Generated from the linked data |
| Versions and approvals | “final_v3_new.docx” | Versioning with review, approval and change log |
| Deadlines and reminders | Calendar entries, if someone remembers | Tasks with due dates and email reminders |
| Several editors | Locked files, copies, conflicting versions | Simultaneous work with permissions per role |
| Evidence in the audit | Gathered from folders and mailboxes | Reports and exports at the push of a button |
| Cost | No licence, but a lot of maintenance time | A licence, but significantly less maintenance time |
Six signs that you have outgrown Excel.
If more than half apply, the spreadsheet is costing you more time than software would cost.
Several people maintain it
Departments, IT and the information security officer work in the same files and overwrite each other’s changes.
Certification is coming up
An ISO 27001 audit or NIS2 evidence is planned, and you are wondering how to prove everything.
References no longer match
Risk R-17 refers to a measure that has long since been renamed or no longer exists.
Deadlines slip through
Reviews, access checks or supplier assessments are forgotten because nobody sends a reminder.
Nobody knows which file is valid
There are several versions of the same policy, and none of them is properly approved.
The security officer administers instead of steering
Most of the time goes into maintaining lists instead of improving security.
Your Excel work is not lost.
What you have built so far is the best basis for switching. Three tips from practice:
Start with the inventory
Transfer assets and suppliers first, because risks and measures build on them.
Import documents
Bring in existing policies from Word and set the version and approval properly at the same time.
Clean up instead of copying
The move is the opportunity to remove duplicates and outdated entries.
The step beyond Excel does not have to be expensive.
WolfISMS is built for SMEs: you import assets and suppliers from Excel and policies from Word, and the free edition shows you without risk whether it fits.