Notes on risk management that works

How to run an ISO 27001 ISMS on spreadsheets

Keep the register small, put the effort into control design, and define the evidence as part of the control. Plus the three things that eventually break a spreadsheet — none of which is the reason usually given.