The data you have to account for
Risk registers, records of processing, asset inventories, audit findings, supplier ratings, budgets and stock — the data a business is expected to keep properly and be able to show. These are the Excel and Google Sheets files that keep it, with the scoring, the validation rules, the overdue logic and the dashboard built before you open them.
You put your own data in; the file classifies, scores and charts it from there. 58 tools in the catalogue, $14.90–$69, instant download on Etsy.
What is in every file
Different subjects, one build standard — every file is a data model first and a spreadsheet second. This holds for all 58 of them.
Excel and Google Sheets, one file
Delivered as .xlsx. Upload it to Drive and open it with Google Sheets and everything still works — only functions both platforms support are used, and there are no macros or VBA anywhere.
The logic is already built
Scoring formulas, dropdown validation, conditional formatting, automatic dates and live charts are wired before you open it. You type your own data into the register; the status, level and dashboard follow.
Filled-in examples you can delete
Every workbook ships with realistic sample rows so you can see how it behaves, plus a Read Me tab explaining each column. Clear the examples and it is your file.
Yours to edit, not to resell
Instant download, unlimited use inside your own organisation or for your own clients. The one thing you cannot do is resell or redistribute the file itself as your own product.
The catalogue
58 toolkits across 6 lines — 3 listed on Etsy so far, the rest going up at 3–5 new toolkits published a day. Anything marked soon is built and queued, not imaginary.
ISO 27001 & information security
The working files an ISMS actually runs on — risk register, Statement of Applicability, internal audit, asset inventory, access reviews, incident log. Scoring, status and dashboards are already wired; you fill in your organisation, not the formulas.
- 5×5 likelihood × impact scoring with automatic risk level and colour bands
- All 93 Annex A (2022) controls listed for applicability, justification and 0–5 maturity
- Treatment plans with owners, due dates, residual risk and overdue flags
- Live dashboards — COUNTIF-driven charts that move as you type
- ISO 27001 Risk Register $19.90
- ISO 27001 Statement of Applicability + Gap Analysis $24.90
- ISO 27001 Internal Audit Toolkit soon $22.90
- ISMS Documentation Register soon —
- Cyber Risk Register soon $22.90
- Information Asset Inventory & Classification soon $19.90
- User Access Review Matrix soon $19.90
- Incident Response Plan & Log soon $19.90
- Security Awareness Training Tracker soon $19.90
- Vendor / Third-Party Risk Management soon $22.90
- ISO 27001 Complete Toolkit (bundle) soon $69
Data protection & privacy (GDPR)
Everything a privacy programme has to be able to show on request: a record of processing, DPIA screening and scoring, data subject requests with the clock running, breach log, retention schedule. Built to be filled in, not read.
- Article 30 record of processing with lawful basis, transfers and safeguards
- DSAR log with automatic statutory deadlines and overdue highlighting
- DPIA screening → risk scoring → mitigation, in one flow
- Retention schedule with auto-calculated disposal dates
- GDPR Compliance Toolkit $22.90
- DPIA Toolkit soon $22.90
- ISO 27701 Privacy Information Toolkit soon $22.90
- Data Retention Schedule & Records Register soon $19.90
Frameworks & regulatory readiness
Self-assessment and readiness trackers for the frameworks that show up in vendor questionnaires and contracts — each one a control-by-control checklist with maturity scoring, gaps, owners and a readiness dashboard.
- Control-by-control checklist with status, evidence reference and owner
- Maturity or readiness scoring that rolls up into an overall percentage
- Gap list generated from what you scored, with priority
- Obligation registers that track the rule, the owner and the next review date
- NIST CSF Assessment Tool soon —
- SOC 2 Readiness Tracker soon —
- PCI DSS Compliance Tracker soon —
- DORA Compliance Toolkit soon —
- HIPAA Compliance Toolkit soon —
- ISO 42001 AI Management Toolkit soon —
- Compliance Obligations & Legal Register soon $19.90
- ESG & Sustainability Reporting Tracker soon $22.90
Quality, environment & safety
The management-system files that keep a certification alive between audits: clause 4–10 gap analysis, objectives, internal audit programme, nonconformities and corrective actions, supplier evaluation, competency and SOP control.
- Clause 4–10 checklist with conformity status and evidence notes
- Aspects/impacts or hazard registers with significance scoring
- Nonconformity → root cause → corrective action → effectiveness check
- Supplier scorecards, training matrices and SOP registers with review dates
- ISO 9001 Quality Management Toolkit soon $22.90
- ISO 14001 Environmental Toolkit soon $22.90
- ISO 45001 Health & Safety Toolkit soon $22.90
- Internal Audit Management soon —
- Nonconformity & CAPA Tracker soon $18.90
- Supplier Scorecard & Approved Vendor List soon $18.90
- Training Matrix & Competency Tracker soon $18.90
- Process & SOP Library soon $17.90
Risk, projects & governance
Registers and trackers that work in any organisation, certified or not — enterprise risk, RAID, RACI, KPIs, OKRs, project plans and budgets, issues, actions and the meetings that generate them. Same engineering, broader use.
- Automatic Gantt bars, milestones and workload built from your dates
- RAG status, weighted scores and progress that calculate themselves
- Owner, due date and overdue logic on every action row
- One dashboard tab per file summarising the whole workbook
- Project Management Dashboard + Gantt soon $19.90
- Business Risk Register soon $19.90
- Risk Assessment Matrix soon $18.90
- Business Continuity Plan (ISO 22301) soon $22.90
- RAID Log soon $14.90
- RACI Matrix soon $16.90
- KPI Dashboard Tracker soon $16.90
- OKR Tracker soon $17.90
- Project Budget & Cost Tracker soon $18.90
- Issue & Action Log soon $16.90
- Stakeholder Management Tracker soon $17.90
- Meeting Minutes & Action Tracker soon $16.90
Business operations, finance & people
The everyday workbooks a small operation runs on — bookkeeping, budgets, cash flow, invoices, stock, quotes, pricing, pipeline, contracts, timesheets and the HR trackers around them. Plain, fast, and built to survive being edited by someone in a hurry.
- Income, expense and margin maths already written — no formulas to build
- Aging, reorder points, renewal alerts and break-even calculated on entry
- Dropdown categories so the reporting tabs never break
- A summary dashboard on every file, ready to print or screenshot
- Small Business Bookkeeping soon $18.90
- Annual Business Budget soon $17.90
- 13-Week Cash Flow Forecast soon $18.90
- Invoice Tracker & Accounts Receivable soon $17.90
- Quote & Estimate Template soon $16.90
- Pricing & Profit Margin Calculator soon $16.90
- Inventory & Reorder Tracker soon $17.90
- Contract Management & Renewal Tracker soon $17.90
- Sales Pipeline & CRM Tracker soon $18.90
- Marketing Campaign & ROI Tracker soon $17.90
- Social Media Content Calendar soon $16.90
- Timesheet & Time Tracking soon $16.90
- Recruitment & Hiring Pipeline Tracker soon $18.90
- Employee Onboarding & Offboarding Tracker soon $18.90
- Employee Leave & PTO Tracker soon $18.90
Three things worth saying plainly
A template is not a certificate. These files help you do the work an auditor will ask about — the register, the gap analysis, the evidence trail — but nobody gets certified by buying a spreadsheet. They do not reproduce the text of any standard either: where controls or clauses appear, it is the identifier and a short descriptive label, nothing more. The standards themselves come from their publishers.
Why these cost $20 and not $250. Consultancies sell the same shape of document as part of an engagement. This is the file on its own, built once and sold many times, so the price is what a digital download is worth — not what an hourly rate is worth. What you skip is the week of building formulas, matrices and dashboards from an empty sheet.
It is all the same subject. The other half of this site is production data-extraction tooling — deciding what a record is, defining fields, validating what lands in them. A risk register and a scraper output are the same object with different owners, and the information-security and privacy tools here come out of that working life rather than a bought template pack. Real formulas, real validation, real charts, in a file that does not fall apart when you edit it.