Why the Excel-Based ISMS Has Its Limits

Spreadsheets are quick to create but difficult to keep up to date. Many IT and security managers are familiar with these common issues from their day-to-day work:

• No clear consensus: Several versions of the same risk list are circulating, and no one knows for sure which one is valid.
• Responsibilities become blurred: Although tasks have a name listed in a column, they lack deadlines, reminders, and visible progress.
• Evidence is missing at the crucial moment: logs, approvals, and screenshots are stored in email inboxes or personal folders. The search begins before the audit.
• Duplicate work across frameworks: Anyone seeking to comply simultaneously with ISO 27001, NIS2 requirements from EU customers, and the Swiss Data Protection Act often ends up maintaining the same control in three separate documents.

The problem is rarely a lack of knowledge. What is missing is a system that links controls, risks, measures, and evidence and shows the current level of compliance at any given time.

What Regulators and Customers Demand Today

The demands for speed and traceability are increasing. Three examples illustrate why saying, “We’ve documented that somewhere,” is no longer enough:

Mandatory Reporting of Cyberattacks in Switzerland

As of April 1, 2025, operators of critical infrastructure must report cyberattacks to the Federal Office for Cybersecurity (BACS) within 24 hours of discovery. Any missing information may be provided within 14 days. As of October 1, 2025, failure to report may result in a fine of up to CHF 100,000. You should check the Information Security Act (ISG) and the Cybersecurity Ordinance to determine whether your company is subject to the reporting requirement. Those required to report need a well-rehearsed incident response process with clear roles and thorough documentation.

NIS2 for Business Relationships with the EU

The EU NIS2 Directive requires the governing bodies of affected organizations to approve risk management measures, monitor their implementation, and participate in training sessions. Swiss companies are not directly subject to these requirements. However, companies with subsidiaries in the EU or those supplying EU customers in regulated sectors often receive these requirements through contracts and supplier questionnaires. Check which of your companies and customer relationships are affected.

Audits and Supplier Evaluations

Whether it’s an ISO 27001 certification audit or a security questionnaire from a major client: What’s required is documentation, not statements of intent. Those who maintain their documentation in a structured and up-to-date manner can respond to such requests in hours rather than weeks.

What "GRC as a Service" Actually Means

GRC as a Service combines a GRC platform with ongoing operations managed by specialists. You receive not just software, but a fully maintained system in which your organization operates. The key components:

• Governance: Policies, roles, and responsibilities are managed centrally, including review cycles and acknowledgment by employees.
• Risk Management: Risks are assessed consistently, linked to specific measures, and tracked over time.
• Compliance Tracking: Requirements from standards such as ISO 27001, NIS2, or data protection laws are mapped to common controls. A control is maintained once and counts toward multiple frameworks.
• Incident Management: Security incidents are systematically recorded, assessed, and assigned deadlines. This also supports reporting processes.
• Audit Readiness: Supporting documentation is located where the control is described and can be compiled as needed for audits or customer inquiries.

In addition, AI agents can handle routine tasks, such as checking documents for completeness or answering employees’ questions about internal policies. The key point here is that professional responsibility remains with humans: The AI prepares the work, but the person in charge is the one who approves it.

How to Make the Switch a Success

Migrating from spreadsheets to a platform doesn't have to be a major project. A step-by-step approach has proven effective:

• Define the scope: Start with a framework and a clearly defined scope, such as ISO 27001 for core IT.
• Take Over Existing Assets: Existing risks, policies, and measures are imported and refined rather than reinvented.
• Assign responsibility: Each control and each risk is assigned to a specific person, along with deadlines.
• Establish a routine: Monthly status reports and an annual management review help track progress.
• Expansion: Additional frameworks, supplier evaluations, or business continuity topics will be added once the foundation is in place.

How can you tell if the switch is worth it? Look for measurable changes in your day-to-day operations: How long does it take to fill out a customer’s security questionnaire? How many actions are overdue, and who is aware of them? How quickly can an up-to-date risk report be made available to senior management? If these questions can be answered without having to search for information, your ISMS is working for you—not the other way around. At the same time, information security becomes transparent to senior management because decisions, risks, and open issues are all visible in one place.