Spreadsheet: 806511d1669355840-searching-for-an-exact-numeric-match-with-a-formula-sample-data-search-and-reporting-1-ans
Sheet: Report

 | ID | mat-1 | mat-2 | mat-3 | mat-4 | mat-5 | mat-6 | scf
 | 5.1
 | 5.2
 | 5.3
 | 15.1
 |  | Note 1: I've replaced the table references (Table1[ID]) by the ranges |  |  |  |  |  |  |  | As an example, this is what Report!(C3) needs to look like (only bringing results from Source that has an identical match to (ID)5.1 (no 15.1, nor 5.12):
 |  | Note 2: Although the formula does not return any errors, it also doesn't bring the results |  |  |  |  |  |  |  | ID | mat-1
 |  | - There is no evidence of a capability to facilitate the implementation of cybersecurity and privacy governance controls. - Security and privacy governance is informally assigned as an additional duty to existing IT or cybersecurity personnel. - Governance focus is narrowly limited to certain compliance requirements. - Compliance requirements for security and privacy are identified and documented. - Controls are assigned to sensitive assets to comply with specific compliance requirements. - A Governance, Risk & Compliance (GRC) team, or similar function, provides governance oversight for the implementation of applicable statutory, regulatory and contractual cybersecurity and privacy obligations that facilitate the implementation of secure practices to protect the confidentiality, integrity, availability and safety of the organization’s applications, systems, services and data. - Formal governance program exists for both security and privacy. - Governance function is formally assigned with defined roles and associated responsibilities. - Compliance requirements for security and privacy are identified and documented. - Controls are assigned to sensitive assets to adhere to specific compliance requirements. - Metrics are used to evaluate the effectiveness of the governance program, based on historical trends. - Formal governance program exists for both security and privacy. - A Governance, Risk & Compliance (GRC) team, or similar function, provides governance oversight for the implementation of applicable statutory, regulatory and contractual cybersecurity and privacy obligations that facilitate the implementation of secure practices to protect the confidentiality, integrity, availability and safety of the organization’s applications, systems, services and data. - Governance function is formally assigned with defined roles and associated responsibilities. - Compliance requirements for security and privacy are identified and documented. - Controls are assigned to sensitive assets to adhere to specific compliance requirements. See SP-CMM4. SP-CMM5 is N/A, since a continuously-improving process is not necessary to facilitate the implementation of cybersecurity and privacy governance controls. GOV-01 - There is no evidence of a capability to establish, maintain and disseminate cybersecurity and privacy policies, standards and procedures. - Basic cybersecurity policies and standards are documented [not based on any industry framework] - Documentation is made available to internal personnel. - Basic procedures are established for important tasks, but are ad hoc and not formally documented. - Cybersecurity policies and standards exist that are aligned with a leading cybersecurity framework (e.g., NIST 800-53, ISO 27002 or NIST Cybersecurity Framework). - Documentation is made available to internal personnel. - Procedures for important tasks are documented and assigned to individuals or teams. - Formal governance program exists for both security and privacy. - Metrics are used to evaluate the coverage of policies and standards against obligations. - Metrics are used to evaluate the execution of key procedures. - A Governance, Risk & Compliance (GRC) team, or similar function, provides governance oversight for the implementation of applicable statutory, regulatory and contractual cybersecurity and privacy obligations that facilitate the implementation of secure practices to protect the confidentiality, integrity, availability and safety of the organization’s applications, systems, services and data. - Cybersecurity policies and standards are verified to address all applicable statutory, regulatory and contractual requirements. - Documentation is made available to internal personnel and third-party stakeholders. - Procedures are standardized across the organization to ensure uniformity and consistent execution. See SP-CMM4. SP-CMM5 is N/A, since a continuously-improving process is not necessary to establish, maintain and disseminate cybersecurity and privacy policies, standards and procedures. GOV-02 - There is no evidence of a capability to review the cybersecurity and privacy program, including policies, standards and procedures, at planned intervals or if significant changes occur to ensure their continuing suitability, adequacy and effectiveness.  - Unstructured review is performed on an annual basis. - Informal recommendations are made to update existing policies and standards. - Documentation change control processes do not exist or are not formal. - People affected by the changes are provided notification of the changes. - Formal review process is performed on an annual basis. - Review process includes the scope of applicable statutory, regulatory and contractual obligations. - Recommendations for edits are submitted for review and are handled in accordance with documentation change control processes. - Updated version is published at least annually, based on the review process. - People affected by the changes are provided notification of the changes. - Governance function is formally assigned with defined roles and associated responsibilities. - Metrics are used to evaluate the number of violations or exceptions to policies and standards. - A Governance, Risk & Compliance (GRC) team, or similar function, provides governance oversight for the implementation of applicable statutory, regulatory and contractual cybersecurity and privacy obligations that facilitate the implementation of secure practices to protect the confidentiality, integrity, availability and safety of the organization’s applications, systems, services and data. - Formal review process is performed on an annual basis, as business conditions require a review, or as metrics indicate a review is necessary. - Review process includes the scope of both currently-applicable and pending statutory, regulatory and contractual obligations. - Recommendations for edits are submitted for review and are handled in accordance with documentation change control processes. - Stakeholders are involved in the review process for proposed changes. - Updated version is published at least annually, based on the review process. - People affected by the changes are provided notification of the changes. See SP-CMM4. SP-CMM5 is N/A, since a continuously-improving process is not necessary to review the cybersecurity and privacy program, including policies, standards and procedures, at planned intervals or if significant changes occur to ensure their continuing suitability, adequacy and effectiveness.  GOV-03 |  |  |  |  |  |  |  | 5.1 | - There is no evidence of a capability to facilitate the implementation of cybersecurity and privacy governance controls. - There is no evidence of a capability to establish, maintain and disseminate cybersecurity and privacy policies, standards and procedures. - There is no evidence of a capability to review the cybersecurity and privacy program, including policies, standards and procedures, at planned intervals or if significant changes occur to ensure their continuing suitability, adequacy and effectiveness.