Guide
Spreadsheet security checklist
TL;DR
The eight practices behind the self-assessment, written out with the reasoning behind each one. This is a general governance checklist, not a certification standard — use it as a starting point for a conversation with your security team.
1. Know how often data actually gets exported
Not whether policy allows it, whether it happens. If exporting to CSV is a routine step in how people get their jobs done, that's the behavior to design around, not a violation to punish.
2. Track exports when they happen
Even a simple log (who exported what, when) turns an invisible risk into a visible one. Without it, there's no way to know what to look for if something does go wrong.
3. Require SSO for sensitive systems
Single sign-on centralizes authentication, and critically, centralizes deauthorization. When someone leaves, one action cuts off access everywhere SSO is enforced.
4. Maintain a real inventory
If a specific dataset were compromised today, could you say with confidence who has (or had) a copy? Most organizations can't, and that gap is exactly what makes breach response slow and expensive.
5. Minimize sharing sensitive data as attachments
Email and chat attachments are another copy, outside any access control, that persists indefinitely in someone's inbox or message history.
6. Apply row- and column-level access controls at the source
Controls configured in the warehouse or BI layer, not in each downstream tool, are the ones that actually hold up when data moves between systems.
7. Make offboarding actually complete
Disabling an account is necessary but not sufficient. The harder question is whether that person's previously exported files are still out there, and whether anyone would notice.
8. Keep sensitive data inside governed systems by default
The most reliable version of every practice above is not needing them in the first place, because the data never left a system that already enforces them.
How exposed is your own workflow?
Take the self-assessment