Security risk practitioners live in spreadsheets. Risk registers, control assessments, maturity models, treatment plans, audit trackers. And almost every one of them ends up in someone else's hands: a colleague, an auditor, an executive, a client. The first thing that person silently asks is always the same.
 
Where am I supposed to type, and what am I not supposed to touch?
 
This guide answers that question before it's asked. It sets out the color scheme and layout conventions that every SRMBOK spreadsheet now uses, from the NIST CSF 2.0 Cyber Maturity Assessment Tool onwards. 
 
Yellow is always an input.
Light blue is always a calculation.
Navy is always a heading.
White is never something you have to fill in.
 
Every sheet is protected without a password, so nothing gets overwritten by accident, but anyone can still adapt it.
 
We're sharing it because it makes spreadsheets look more professional, makes them far easier to hand over, and means anyone who has learned the palette in one workbook can open any other and instantly know how it works. It's a recommendation, not a rule. If you'd rather use your own scheme, that's fine. The important thing is to have one, write it down, and use it everywhere. If you do adopt ours, your spreadsheets and ours will read the same way.
 
What's inside (5 pages, full color, A4 PDF)
The eight cell styles, with swatches, hex codes and exactly how each is used
Tab color families and the standard tab order for an example workbook
The layout of a working tab, from title bar to freeze panes
How to protect sheets without locking people out
A pre-release checklist and a one-page quick reference
 
No cost, no catch. Use it, adapt it, or just borrow the parts that help.