Cybersecurity Framework
Spreadsheet Security Threat Model
Applying established cybersecurity frameworks to the tabular threat landscape. Because your spreadsheet is an attack surface.
Threat Landscape
Attack Vectors
Understanding the ways your spreadsheets can be compromised.
Data Poisoning Attacks
Adversarial modification of source data rows to corrupt downstream calculations.
- •What if someone changes Q3 revenue from 47,000 to 470,000?
- •Silent corruption through autocorrect (SEPT1 → September 1)
- •Historical data manipulation affecting trend analysis
- •The "fat finger" attack vector: 0.01 vs 0.10 vs 1.00
Formula Injection Attacks
Malicious formulas embedded in imported data files that execute on open.
- •CSV imports with embedded =CMD() payloads
- •DDE (Dynamic Data Exchange) command execution
- •=WEBSERVICE() for data exfiltration
- •Hyperlink injection for credential harvesting
Supply Chain Vulnerabilities
Third-party dependencies and linked workbooks from untrusted sources.
- •Template poisoning via "official budget template"
- •Linked workbook references to compromised servers
- •Third-party add-in and macro risks
- •That one cell referencing a file on Dave's laptop
Insider Threats
The person who built the spreadsheet has always left the organization.
- •Single points of failure ("only Janet understands Q4")
- •Privilege escalation via "edit access" sharing
- •The quiet fix: correcting errors without documentation
- •Knowledge hoarding as job security
Agency Spreadsheet Usage Guidelines
Model policy for government agencies at federal, state, and local levels. Adapted from established AI governance frameworks.
Executive Summary
“Spreadsheet technologies have grown from a niche tool to ubiquitous systems with billions of users. The Agency recognizes the opportunity for a controlled, ethical, and responsible approach to spreadsheet use that acknowledges the benefits to efficiency while mitigating the risks around spreadsheet bias, privacy, and cybersecurity.”
Information entered into spreadsheets may be subject to a FOIA/Public Records Act request may be viewable by anyone with "edit access," and may be leaked when someone accidentally emails the wrong attachment. Do not enter information not suitable for public release into cells.
Review, revise, and fact-check via multiple sources any calculations from a spreadsheet as these systems can make mistakes. Users are responsible for the accuracy of material created with spreadsheet assistance. The spreadsheet does not guarantee accuracy.
Limit the environmental impact of your spreadsheet usage by using calculators for simple math, minimizing formulas where feasible, and putting boundaries on outputs when you only need a few numbers (e.g., instructing your spreadsheet to "only calculate Q4").
Always cite spreadsheets used in decisions Citing spreadsheets maintains trust with the public that content published by the Agency is reliable and overseen by human staff, not just "whatever the spreadsheet said."
Record at least one instance of your spreadsheet use via the Agency's Spreadsheet Intake Form. This informs improvements to staff training and spreadsheet guidance.
Privacy
Submit information to spreadsheets that is ready for public disclosure. Be mindful that spreadsheet output may include unexpected personal information from another tab.
Transparency
Users shall be clear when using spreadsheets in decision-making. This includes citing that you used a spreadsheet in creating a recommendation.
Equity
Spreadsheet responses are based on formulas derived from existing human knowledge, which may contain errors and is historically biased.
Accountability
The person using a spreadsheet is accountable for its outputs. Use spreadsheets with healthy skepticism. "The spreadsheet says so" is not a defense.
Prohibited Spreadsheet Uses
Evaluations and Decisions: Evaluating job applicants using spreadsheets has led to countless scandals of biased reviews. Spreadsheet-based evaluations expose the Agency to public protest. The actual evaluation must be made by a person.
Required Citation Format
Note: The public finding out you used a spreadsheet without disclosure can cause reputation harm to the Agency.