GOVERNANCE · RISK · COMPLIANCE

GRC Starter Templates

Six original Excel trackers for teams that run security work in spreadsheets

Risk, evidence, remediation, vendors, policies and assessment scope. Each file has 100 prepared rows, status dropdowns, filters and a frozen header. No macros, no sign-up, nothing uploaded: download, fill the pale-yellow cells and keep your copy in your own storage.

Download a tracker Source on GitHub Author site

MIT licensed, including commercial use · Verified by a read-only integrity check on every push · Version 1.0.1

Scope, evidence, risk, remediation and review flow

The six trackers

Risk register previewDOWNLOAD .XLSXRisk registerRisks with owner, treatment and an organization-defined likelihood x impact score.Risk ID · Risk description · Owner · Likelihood (1-5) · Impact (1-5) · Score · Treatment · Status · Review date · Notes Evidence register previewDOWNLOAD .XLSXEvidence registerEvidence requests, file references, reviewers and expiry dates.Evidence ID · Evidence description · Control / requirement · Owner · File reference · Collected date · Expiry date · Reviewer · Status · Notes Remediation tracker previewDOWNLOAD .XLSXRemediation trackerGaps and actions with owner, priority, deadline and completion evidence.Action ID · Gap / action · Requirement · Owner · Priority · Due date · Status · Completion evidence · Reviewer · Notes Vendor review previewDOWNLOAD .XLSXVendor reviewThird-party due diligence, data handled and follow-up actions.Vendor ID · Vendor name · Service · Data handled · Business owner · Review due · Status · Review evidence · Follow-up action · Notes Policy register previewDOWNLOAD .XLSXPolicy registerPolicies with version, approver, approval and next review dates.Policy ID · Policy title · Owner · Version · Document reference · Approval date · Next review · Status · Approver · Notes Assessment scope previewDOWNLOAD .XLSXAssessment scopeApplicable requirements, decisions, evidence references and rationale.Item ID · Requirement / question · Source / version · Applicability · Owner · Decision · Evidence reference · Reviewer · Review date · Rationale

How they connect

How the six trackers connect

A practical first week

  1. Agree one business scope and assign a reviewer.
  2. Record the requirements you have rights to use in Assessment scope.
  3. Log missing proof in the Evidence register; keep file references private.
  4. Record material risks in the Risk register with an owner and an agreed scoring method.
  5. Give each gap a remediation owner and deadline in the Remediation tracker.
  6. Review the records and update decisions. A filled workbook is not evidence of compliance.
What these are not. The files contain no complete ISO 27001, SOC 2, GDPR, Saudi or UAE requirement catalogue. They do not verify controls, run monitoring or certify compliance. Excel is the intended format; Google Sheets round trips are unverified. Add only content you have rights to use. Usage notes: TERMS.txt.