A fully worked physical security risk assessment in MS Excel. Live 5×5 matrix, ISO 31000 treatment options, residual tracking against appetite, and a dashboard that updates as you type.
 
 
Stop rebuilding the same register from scratch.
 
This is a complete physical security risk assessment workbook in MS Excel, built on the SRMBOK method and ISO 31000:2018. It ships with a full worked example — Acme Tower, a fictitious multi-tenant regional headquarters — so you can see how twelve real physical security risks are written, rated, treated, and accepted before you touch a cell.
 
What's inside
 
One row, one risk. Every risk is written as an event, source, and impact, so treatments can be aimed at how it happens and what it does.
A live 5×5 matrix. Ratings are calculated, never typed. Change the matrix on the Lookups tab to match your organisation's appetite and every risk re-rates instantly.
ISO 31000 treatment options. Treat, Tolerate, Share or Terminate. Share is used deliberately instead of Transfer — a third party or insurer can fail, and the residual comes straight back to you.
Residual tested against target. Set the residual each risk must reach. The workbook tells you whether you got there, and flags the ones still sitting outside appetite.
A dashboard that does the reporting for you. Risk counts, current-versus-residual movement, a rating profile chart, risks by threat category, and an open-item tracker that lists only the rows still needing action.
Fourteen physical security threat categories ready to use — PMV, civil disorder, burglary, unauthorized access, insider threat, hostile reconnaissance, mail threat, hostile vehicle, contractor and loading dock, utilities interference, and more.
Guidance built into the sheet. Cell comments on every column explain what good looks like. Color-coded inputs mean you always know which cells are yours to fill.
 
Dropdowns are driven by editable lists. Formulas are protected but unlocked — no password, so adapt anything you like. Use it as a training file with the Acme example intact, or replace the site details and have a defensible register for your own building by the end of the afternoon.