Free · CC BY 4.0 · No signup

GRC templates that hold up in an audit.

Four working Excel registers built against the primary texts: the EU AI Act, ISO/IEC 42001, NIST and India's DPDP Rules. 5,367 live formulas, worked examples, and dashboards your risk committee can read.

By John Bommeraveni Joseph
ISO 27001, 42001 & 27701 Lead Auditor
The templates

Built to be used on Monday, not admired on Friday.

Every template opens on a "Start here" tab, ships with a worked example, and flags its own gaps: an unclassified AI system, a quantum-vulnerable key exchange, a vendor red flag, a DPDP deadline.

AI governance

AI System Inventory & Risk Register

One register for every AI system you build, buy or use, mapped to EU AI Act roles and risk classes and ISO/IEC 42001 Annex A.

  • 26-field inventory that warns you: prohibited practice, unclassified system, the "lethal trifecta"
  • Risk register in cause, event, consequence form, with inherent and residual scoring
  • Board dashboard and a live 5 × 5 heat map
Download (.xlsx) 7 sheets · 1,391 formulas
Post-quantum

Crypto Inventory & PQC Migration Workbook

Find where your quantum-vulnerable cryptography lives and plan the move to NIST FIPS 203, 204 and 205, with deadlines verified against the primary texts.

  • Classifies every algorithm automatically and flags harvest-now, decrypt-later exposure
  • Mosca test with a planning value you own and sign off
  • Deadlines from NIST IR 8547 (final), US EO 14412, UK NCSC and the EU roadmap
Download (.xlsx) 9 sheets · 2,256 formulas
Third-party risk

AI Vendor Due-Diligence Questionnaire

74 questions that get past the logo slide: training on your data, silent model changes, agent permissions, AI-incident notice and exit.

  • What good evidence looks like, for every question
  • Weighted scoring across 14 sections, red flags on critical answers
  • A recommendation you can defend: approve, conditions, escalate or reject
Download (.xlsx) 74 questions · 917 formulas
Privacy · India

DPDP Act & Rules Readiness Checklist

99 requirements from the Digital Personal Data Protection Act 2023 and the DPDP Rules 2025, each with its section or rule and who it falls on.

  • Applicability screen that switches rows on and off
  • Phase dates from the official Gazette, with live countdowns
  • Readiness by area, open high-priority gaps and the penalty schedule
Download (.xlsx) 99 requirements · 803 formulas
How to use them

A first pass takes an afternoon, not a project.

1

Download

Pick the template for the problem in front of you. No account, no email, no tracking.

2

Open "Start here"

Every workbook explains itself on its first tab and ships with a worked example in row 6.

3

Fill the yellow cells

Grey cells calculate. The flags and the dashboard update as you go, so the gaps find you.

John Bommeraveni Joseph
Made by

John Bommeraveni Joseph

ISO 27001, 42001 & 27701 Lead Auditor, Co-Founder & CPTO at Purplecop Security, and creator of the free GRC Practice Lab used by more than 10,000 people in 34 countries. New templates land first on LinkedIn, alongside the free weekday newsletter, GRC Made Simple Daily, and the walkthroughs on the GRC Made Simple YouTube channel.