Some quick background: I work for the system office of a university and we are in the procurement process for a proper GRC tool to use for all of the campuses. Unfortunately, the procurement process isn't expected to be done until Dec./Jan. and we need something to fill in the gap for audits.

Request: Does anybody know of an easy to use form/template/spreadsheet that end-users can fill out, place a risk rating, and get a low/medium/high rating? We've tried to use an Excel spreadsheet that my boss pulled from NIST but we are requiring individual links to the documentation and as we found out the hard way, you can't use more than one link in a particular cell. I've also tried to rebuild that spreadsheet in a Word doc. with some success but it gets clunk, especially with larger sections like access control.

I came across this post from a few years ago, but was wondering if anybody had something a bit newer? TiA!!!