Data import wizard

Guidelines on data import format

Applicable for: Data import wizard UI (Pro) and CLI (Community or Pro)

Importing existing data from excel sheets is supported on the Pro plan through the UI and CLI, and on Community edition through the dedicated CLI, not a django command. The cli is available on the cli folder with the associated instructions. Keep in mind that the CLI needs to reach the API as it wraps its actions around it. The mention to the API is regarding the fact that users on both plans can still interact with the API directly in case they have some data prep phase on their end for batch import or equivalent.

Connection Error

If you encounter this error, it could be due to the Excel file being protected by Information Rights Management (IRM).

IRM protection restricts access to the file and prevents it from being read by external tools such as data-wizard.

How to fix

To resolve this issue, use an unprotected version of the file:

• Download a copy of the file (File → Create a Copy → Download a Copy)

• Or export the file as CSV

• Or remove IRM protection using the desktop version of Excel

Overview

The Data Import Wizard and the CLI both support batch creation and updates of fields. They provide the same capabilities; the only difference lies in how the import is initiated:

• through the user interface for the Data Import Wizard

• through the command line for the CLI

When an object already exists during an import, one of the following conflict-resolution strategies can be applied:

• Stop the import (default): the import is aborted as soon as a conflict is detected

• Skip the row: the existing field is left unchanged and the import continues

• Update the row: the existing field is updated with the imported data

The Update strategy enables batch updates of existing fields and is particularly useful for changes that could technically be performed through the graphical interface, but become tedious or error-prone when repeated across many objects. In such cases, downloading the existing objects, applying the required transformations in an Excel file, and re-importing the updated data can be significantly faster and more reliable than performing the same actions manually in the UI. This approach reduces repetitive interactions, minimizes the risk of manual mistakes, and provides a clear, auditable workflow for large-scale updates.

In this workflow, it is strongly recommended to retain the field IDs (UUIDs) in the import schema. Doing so ensures reliable object matching during re-import, even if other attributes (such as names or labels) have changed, making the update process fail-safe.

If the imported object supports the domain attribute, the wizard will attempt to assign it to the specified domain, provided you have the required permissions. If no domain is specified, the wizard will automatically fall back to the default domain configured in the wizard form.

Fields with (*) are mandatory and don't have any supported fallback.

Unless marked as mandatory, ref_id fields can be left blank but the column must still exist.

Assets

Template

sample001.xlsx

9KB

Open

Supported fields

• ref_id

• name*

• description

• domain

• type

  • PR : primary

  • SP : supporting

• reference_link - URL reference; also accepted as link

• observation

• filtering_labels - pipe- or comma-separated label names (created if missing)

• parent_assets -comma- or pipe-separated list of parent asset ref_id values; parent links are resolved after all assets in the file are created, so forward references are supported

• security_objectives

  • confidentiality: 3,integrity: 2,availability: 1,...

• disaster_recovery_objectives

  • rto: 1h01m01s,rpo: 2h01m01s,mtd: 3h

• labels

• is_business_function (either true/yes or false/no)

Special considerations

• type will default to supporting if the column does not exist

Applied controls

Template

applied_controls_sample (2).xlsx

11KB

Open

Supported fields

• ref_id

• name*

• description

• domain

• status

  • to_do

  • in_progress

  • on_hold

  • active

  • deprecated

• category

  • policy

  • process

  • technical

  • physical

  • procedure

• priority

  • integer from 1 to 4

• csf_function

  • govern

  • identify

  • protect

  • detect

  • respond

  • recover

• effort — size estimate

  • XS

  • S

  • M

  • L

  • XL

  • full names also accepted, e.g. Extra Small

• control_impact - integer 1–5; also accepted as impact

• start_date - date (YYYY-MM-DD)

• eta - estimated completion date (YYYY-MM-DD)

• expiry_date - expiry date (YYYY-MM-DD)

• link - URL

• observation - free-text observation

• filtering_labels - pipe- or comma-separated label names (created if missing)

• reference_control - lookup by ref_id; also accepted as reference_control_ref_id

• owner

• cost_amortization_period - integer (1–50), defaults to 1

• cost_build_fixe - number, defaults to 0

• cost_build_people_days - number, defaults to 0

• cost_run_fixed - number, defaults to 0

• cost_run_people_days - number, defaults to 0

Special considerations

• status will default to to_do

• csf_function will default to govern

• The owner field resolves against existing users (by email) and teams (by name). Ensure any referenced users and teams are created before importing. Unresolved entries are skipped with a warning and will not block the import.

Perimeters

Template

sample003.xlsx

7KB

Open

Supported fields

• ref_id

• name*

• description

• domain

• status

  • undefined

  • in_design

  • in_dev

  • in_prod

  • eol

  • dropped

• default_assignee

  • User email or team name, semicolon-separated

Special considerations

• If the default_assignee column is present and empty, the import would end up cleaning existing assignee.

Audits

Template

To avoid any mixup on the expected fields and the requirements reference, you can get a template for the expected framework by going into Catalog/Frameworks

The framework needs to be loaded and when clicking on it, you'll see a button to get the excel file.

Supported fields

• urn*

• assessable

• ref_id*

• name

• description

• compliance_result

  • not_assessed

  • partially_compliant

  • non_compliant

  • compliant

  • not_applicable

• requirement_progress

  • to_do

  • in_progress

  • in_review

  • done

• score

  • integer within the requirement's effective scale — the audit's min_score/max_score, or the requirement's own bounds when it overrides them. Out-of-range values are rejected.

• is_score_overridden

  • text: true, yes, y, 1, oui, vrai, x for true — false, no, n, 0, non, faux for false. Any other text is rejected and the row fails, so a typo can't silently clear an existing override.

  • numbers: only 0 (false) and 1 (true) are accepted; any other number is rejected.

  • Only meaningful on requirements that carry questions: it decides whether the imported score is pinned or recomputed from the answers. Leave the cell blank (or the column out entirely) and any imported score on a question-driven requirement is pinned automatically.

• observations

Special considerations

• The wizard will attempt to match based on the ref_id and fallback to the urn otherwise. If none could be used, the row will be skipped.

• name and description columns are not used but serve as an anchor point for reference.

• Assessable will fallback to false

• Unassessable rows are skipped.

Findings followup (eg. pentest)

Template

sample004.xlsx

6KB

Open

Supported fields

• ref_id

• name*

• description

• severity

  • low

  • medium

  • high

  • critical

• status

  • identified

  • confirmed

  • dismissed

  • assigned

  • in_progress

  • mitigated

  • resolved

  • deprecated

• filtering_labels you can add multiple labels for one finding separating them with | ( e.g. internal|pentest|...)

• priority -integer 1–4

• eta - estimated resolution date (YYYY-MM-DD)

• due_date - due date (YYYY-MM-DD)

• observation

• vulnerabilities Pipe or comma-separated vulnerability names

• asset Name or ref_id of a single asset, looked up in the domain folder. A finding carries one asset, so if the cell holds several names only the first is linked and the row is reported as a warning. A missing asset is created in the domain folder with the default type Support, provided you may add assets there.

Users

Template

sample005.xlsx

9KB

Open

Supported fields

• email*

• first_name

• last_name

Risk assessment

The risk assessment is an advanced object that needs special considerations. Make sure to pick the matrix that will be used to map your labels to the values on CISO Assistant. If you have a specific matrix, you should start by including it as a custom library.

inherent_level, current_level and residual_level are kept on the excel sample just for visual aid. The application computes them based on impact and probability to ensure consistency with the matrix definition.

Controls are created on picked based on the perimeter's domain. Line breaks are used as seperator.

Template:

risk_assessment_template.xlsx

6KB

Open

Supported fields:

• ref_id: String

• name*: String

• description: String

• inherent_impact: String¹

• inherent_proba: String¹

• existing_controls: String Newline-, semicolon- or comma-separated control names.

• current_impact: String¹

• current_proba: String¹

• additional_controls: String Newline-, semicolon- or comma-separated control names.

• residual_impact: String¹

• residual_proba: String¹

• treatment: String

  • open

  • mitigate

  • accept

  • avoid

  • transfer

• assets Newline-, semicolon- or comma-separated asset names or ref_ids. Missing assets are auto-created in the domain folder with the default type Support, provided you may add assets there — otherwise the name is reported as a warning on the row.

• justification: String

1: The string must represent a value present in the chosen risk matrix

Business Impact Analysis

The BIA export/import uses a multi-sheet Excel file:

• Summary sheet - one row per BIA

• <BIA name> sheet - one row per asset assessment for that BIA

• <BIA name> - thresholds sheet - one row per escalation threshold for that BIA

Template

sample_business_impact_analysis (1).xlsx

9KB

Open

---

Summary sheet

Supported fields

• name*

• description

• perimeter - name of the perimeter

• perimeter_ref_id - ref_id of the perimeter

• risk_matrix - name of the risk matrix

• risk_matrix_ref_id - ref_id of the risk matrix

• folder - domain/folder name

• version

• status

  • planned

  • in_progress

  • in_review

  • done

  • deprecated

• eta - estimated completion date

• due_date

• observation

• authors - comma-separated list of user emails

• reviewers - comma-separated list of user emails

Special considerations

• status defaults to planned if not provided

• perimeter and risk_matrix are resolved by UUID, ref_id, or name (in that order)

• authors and reviewers are matched by email address

---

Asset assessment sheets (<BIA name>)

One sheet per BIA, named after the BIA. Each row is an asset assessment.

Supported fields

• bia_name* - name of the parent BIA (injected automatically on re-import)

• asset* - name of the asset

• asset_ref_id - ref_id of the asset (alternative lookup)

• recovery_documented - true / false

• recovery_tested - true / false

• recovery_targets_met - true / false

• dependencies - comma-separated list of asset names or ref_ids

• associated_controls - comma-separated list of applied control names or ref_ids

• evidences - comma-separated list of evidence names

• observation

Special considerations

• asset is resolved by UUID, ref_id, or name (in that order)

• Boolean fields accept true/false, yes/no, 1/0

• Multiple values (dependencies, controls, evidences) use comma separation

---

Threshold sheets (<BIA name> - thresholds)

One sheet per BIA, named <BIA name> - thresholds. Each row is an escalation threshold.

Supported fields

• bia_name* - name of the parent BIA

• asset* - name of the asset (used to resolve the asset assessment)

• asset_ref_id - ref_id of the asset (alternative lookup)

• point_in_time* - integer (time horizon in hours/days depending on your matrix)

• quali_impact - integer qualitative impact level (-1 = not set)

• quanti_impact - decimal quantitative impact value

• quanti_impact_unit - unit for quantitative impact (e.g. currency)

• qualifications - comma-separated list of qualification names

• justification

Special considerations

• The asset assessment is resolved by matching (bia_name, asset) — both must already exist before thresholds are imported

• point_in_time combined with the asset assessment forms the unique key for update/deduplication

• quali_impact defaults to -1 (not set) if blank

• quanti_impact defaults to 0 if blank

Elementary actions

Elementary actions are useful to model a killchain during the 4th workshop of an EBIOS RM study.

Supported fields:

• ref_id

• name*

• description

• attack_stage*

  • (in English)

    • know

    • enter

    • discover

    • exploit

  • (in French)

    • connaitre

    • entrer

    • trouver

    • exploiter

• icon

  • server

  • computer

  • cloud

  • file

  • diamond

  • phone

  • cube

  • blocks

  • shapes

  • network

  • database

  • key

  • search

  • carrot

  • money

  • skull

  • globe

  • usb

• domain

sample007.xlsx

9KB

Open

CyFun self-assessment

The official self-assessment Excel workbook published by Belgium's Centre for Cybersecurity for the CyFun 2025 framework — BASIC, IMPORTANT, and ESSENTIAL editions are all accepted. The import creates a new audit, loads the CyFun 2025 framework automatically if needed, sets the implementation group from the detected assurance level, and carries over documentation/implementation scores, N/A markers, and comments. See CCB CyFun for details.

Selected in the wizard as CyFun self-assessment; on the CLI: import-cyfun-assessment.

EBIOS RM Studies

Importing a full EBIOS RM study creates the study itself plus the objects across workshops 1–4 (assets, feared events, RO/TO couples, stakeholders, strategic and operational scenarios, attack paths, elementary actions, operating modes). Three input formats are supported. All three require a risk matrix to be selected in the wizard — the probability and impact labels in the source are resolved against that matrix.

Agile Risk Manager (ARM) — Excel

The Excel export produced by Agile Risk Manager (All4Tec). The file contains 91 sheets organised by EBIOS workshop. Both French and English ARM exports are accepted; sheet and column names are matched against known variants.

Selected in the wizard as EBIOS RM Study (ARM).

CISO Assistant — Excel

The Excel format produced by CISO Assistant's own EBIOS RM study export — sheets prefixed 1.1 Study, 1.3 Feared Events, 2.1 RO/TO, and so on. This is the round-trip format: export, edit, re-import.

Selected in the wizard as EBIOS RM Study (Excel).

Egerie Suite — XML

The XML export produced by the Egerie Suite risk-management platform. The only XML target supported by the wizard; everything else accepts Excel or CSV. Egerie's internal cross-references (PA_, SA_, FE_, RS_, …) are resolved automatically.

Selected in the wizard as EBIOS RM Study (Egerie XML).

Reference controls

Reference controls are templates of the controls to apply.

Supported fields:

• ref_id

• name

• description

• category

• function

• domain

sample_reference_controls.xlsx

6KB

Open

Reference controls can be bundled also as a library.

Threats

• ref_id

• name

• description

• domain

sample_threats.xlsx

5KB

Open

Third parties ecosystems

Adding entities, solutions and contracts go through the same file to be able to keep consistent relationships. Each concept needs to be on a separate tab of the excel sheet.

third_parties_ecosystem_template.xlsx

11KB

Open

The file has to be divided into 3 sheets namely "Entities", "Solutions" and "Contracts"

Supported fields

*: Required fields

Entities

• ref_id

• name *

• description

• mission

• country (Country code https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2)

• currency (ISO 4217 format https://en.wikipedia.org/wiki/ISO_4217)

• parent_entity_id

• dependency(Integer in [0,4])

• penetration (Integer in [0,4])

• maturity (Integer in [1,4])

• trust (Interger in [1,4])

• domain *

[!NOTE] Conflict detection: by name + folder

Solutions

• ref_id

• name *

• description

• provider_entity_ref_id - one of provider_entity_ref_id or provider_entity_name is required

• provider_entity_name - lookup by entity name, used only when provider_entity_ref_id is not provided (a provided but unknown ref_id fails the row)

• criticality (Integer in [1,4])

[!NOTE] Conflict detection: by name + folder

Contracts

• ref_id

• name *

• description

• provider_entity_ref_id - one of provider_entity_ref_id or provider_entity_name is required

• provider_entity_name - lookup by entity name, used only when provider_entity_ref_id is not provided (a provided but unknown ref_id fails the row)

• solution_ref_id accepts multiple solution references (newline/pipe/comma)

• status can be draft , active,expired or terminated

• start_date (YYYY-MM-DD format https://en.wikipedia.org/wiki/ISO_8601)

• end_date (YYYY-MM-DD format https://en.wikipedia.org/wiki/ISO_8601)

• annual_expense

• currency (ISO 4217 format https://en.wikipedia.org/wiki/ISO_4217)

• domain

• lei

• euid

• vat

• duns

[!NOTE] Conflict detection: by name + folder

Entity assessments

• name *

• entity_ref_id - one of entity_ref_id or entity_name is required

• entity_name - lookup by entity name, used only when entity_ref_id is not provided (a provided but unknown ref_id fails the row)

• description

• domain

• perimeter or perimeter_ref_id

• due_date (YYYY-MM-DD format)

• criticality (Integer in [1,4])

• solution_ref_id accepts multiple solution references (newline/pipe/comma)

• audit_ref_id - links the assessment to an existing audit, resolved by ref_id

• audit_name - lookup by audit name, used only when audit_ref_id is not provided (a provided but unknown ref_id fails the row)

[!NOTE] Conflict detection: by entity + name + folder

[!NOTE] Linking to an existing audit always moves it: the audit is relocated into the entity assessment's dedicated enclave folder, and its perimeter is cleared (enclave audits carry no perimeter).

[!NOTE] Recommended workflow for importing entity assessments with audits: the EntityAssessments sheet links to audits, it does not create them. First import or create the audits, for example in a temporary domain created for the import. Each row matches its audit by audit_ref_id when provided, otherwise by audit_name; a ref_id on the audit is optional, but is the recommended identifier when several audits could share a name. The importing user must have edit rights on the audits — audits the user cannot modify are reported as not found. Each matched audit is moved out of the temporary domain into the entity assessment's enclave, so once the import succeeds that domain no longer contains them and can be deleted.

Representatives

• email *

• first_name

• last_name

• description

• phone

• role

• provider_entity_ref_id - one of provider_entity_ref_id or provider_entity_name is required

• provider_entity_name - lookup by entity name, used only when provider_entity_ref_id is not provided (a provided but unknown ref_id fails the row)

[!NOTE] Conflict detection: by email

Processings

Two file layouts are accepted for privacy processings:

• a flat sheet (or CSV) with one row per processing — useful for bulk-creating register entries

• a multi-sheet workbook that carries one processing together with its sub-objects (purposes, personal data, data subjects, data recipients, contractors, transfers)

The multi-sheet workbook is the same format produced by the Export XLSX button on a processing's detail page, so a register entry can be exported, edited or moved, and re-imported as-is — sub-objects included. On the CLI, both layouts go through the same import-processings command.

Flat list

Template

sample-processings (1).xlsx

6KB

Open

Supported fields

• ref_id

• name*

• description

• domain

• status - raw key (e.g. privacy_draft) or label

  • Draft

  • In review

  • Approved

  • Deprecated

• processing_nature - comma-separated processing nature names

• information_channel

• usage_channel

• assigned_to - comma-separated user emails

• labels - comma-separated label names (created if missing)

• dpia_required

  • FALSE

  • TRUE

• dpia_reference

[!NOTE] Conflict detection: by ref_id + domain, falling back to name + domain

Multi-sheet workbook

Template

sample_processing_workbook.xlsx

8KB

Open

The workbook contains a Processing sheet (same columns as the flat list, one row) plus one optional sheet per sub-object type: Purposes, Personal data, Data subjects, Data recipients, Contractors and Transfers. Sheet names are matched case-insensitively; empty sheets are simply skipped.

Every choice column accepts either the raw key (e.g. privacy_contract) or its English label (e.g. Performance of a Contract), case-insensitively.

Purposes sheet

• name

• description

• legal_basis - GDPR Article 6 lawful basis; defaults to privacy_consent when blank

• article_9_condition - GDPR Article 9(2) condition, optional

Personal data sheet

• name

• description

• category* - name of a personal-data category from the terminology (e.g. privacy_health_data)

• retention

• deletion_policy

• is_sensitive - true / false; forced to true automatically for GDPR Article 9/10 categories

• assets - comma-separated asset names; the assets must already exist

Data subjects sheet

• name

• description

• category* - e.g. privacy_employee, privacy_customer

Data recipients sheet

• name

• description

• category* - e.g. privacy_data_processor, privacy_regulatory_authority

Contractors sheet

• name

• description

• entity - name of an existing third-party entity, optional

• relationship_type* - e.g. privacy_data_processor, privacy_joint_controller

• country* - ISO 3166-1 alpha-2 code (e.g. FR) or country name

• documentation_link - URL

Transfers sheet

• name

• description

• entity - name of an existing third-party entity, optional

• country* - ISO 3166-1 alpha-2 code or country name

• transfer_mechanism - GDPR Chapter V mechanism, optional

• guarantees

• documentation_link - URL

Special considerations

• Sub-objects are attached to the processing described on the Processing sheet. A processing column (name, ref_id or UUID) on a sub-object row overrides this when present.

• Sub-objects always land in the same domain as their parent processing.

• If the domain column is filled on the Processing sheet, it takes precedence over the domain selected in the wizard — importing an unedited export therefore restores the processing into its original domain. Clear or change the cell to import elsewhere.

• Referenced records (entities, assets, terminology categories) are matched by name and must already exist; an unresolved reference fails that row without blocking the rest.

• Conflict resolution applies to sub-objects too: re-importing the same workbook with Skip creates no duplicates, and Update refreshes sub-objects whose identifying fields (e.g. name and category, within the same processing) still match; a row whose identifying fields changed is treated as a new record.

Policies

policies_template.xlsx

9KB

Open

Supported fields

• ref_id

• name

• description

• domain

• status

• link

• csf_function - defaults to govern

  • govern

  • identify

  • protect

  • detect

  • respond

  • recover

• priority

  • integer 1–4

• effort

  • size estimate: XS, S, M, L, XL

• eta

  • estimated completion date (YYYY-MM-DD)

• expiry_date

  • expiry date (YYYY-MM-DD)

• filtering_labels

  • pipe- or comma-separated label names (created if missing

Exceptions

exceptions_template.xlsx

9KB

Open

Supported fields

• ref_id

• name

• description

• domain

• status

  • draft, in_review, approved, resolved, expired, deprecated

• severity

  • undefined, info, low, medium, high, critical

• expiration_date

  • YYYY-MM-DD

• observation

Incidents

incidents_template.xlsx

9KB

Open

Supported fields

• ref_id

• name

• description

• domain

• status

  • new, ongoing, resolved, closed, dismissed

• severity

  • critical/sev1(1), major/sev2(2), moderate/sev3(3), minor/sev4(4), low/sev5(5), unknown(6)

• detection

  • internal/internally_detected, external/externally_detected

• reported_at

  • DateTime

• link

  • URL reference

• filtering_labels

  • pipe- or comma-separated label names (created if missing)

Vulnerability

template_vulnerabilities.xlsx

6KB

Open

Supported fields

• ref_id

• name*

• description

• status

  • Potential

  • Exploitable

  • Mitigated

  • Not exploitable

  • Fixed

  • Unaffected

• severity

  • Information

  • Low

  • Medium

  • High

  • Critical

• assets (newline-separated list of the name of the assets)

• applied_controls (newline-separated of the names)

• security_exceptions (newline-separated of the names)

Folders

Folders (domains) are the top-level organisational units in CISO Assistant. Importing them lets you pre-populate a domain hierarchy before importing other objects.

Supported fields

• name*

• description

• domain - name of the parent folder, must match exactly one existing folder name (case-insensitive)

Template

sample_folders.xlsx

8KB

Open

Special considerations

• Conflict detection is performed by name + parent folder.

• When domain is left blank the folder is attached to the root of the tenant.

• An error is returned if domain matches more than one folder name.

---

Tasks

Tasks in CISO Assistant are modelled as TaskTemplates (definitions) with TaskNodes (individual occurrences). A non-recurrent task has one node; recurrent tasks generate one node per scheduled occurrence.

The wizard imports both in a single multi-sheet Excel file: a Summary sheet for the templates, plus one sheet per template that contains its past occurrences. A flat CSV upload is also accepted and imports templates only. On the CLI, the corresponding command is import-tasks.

Template

sample_task-templates.xlsx

12KB

Open

Supported fields — Summary sheet

• ref_id — reference identifier; used as the primary conflict-detection key when present

• name*

• description

• folder — folder name; falls back to the domain selected in the wizard

• is_recurrent

  • true / yes / 1

  • false / no / 0

• enabled

  • true / yes / 1 (default)

  • false / no / 0

• link - URL

• task_date (YYYY-MM-DD)

• assigned_to - comma- or semicolon-separated list of user emails and/or team names

• assets - comma-separated asset names or ref_ids

• applied_controls - comma-separated control names or ref_ids

• evidences - comma-separated evidence names

• compliance_assessments - comma-separated assessment names or ref_ids

• risk_assessments - comma-separated assessment names or ref_ids; the name - version format produced by the export is accepted

• findings_assessment - comma-separated findings assessment names or ref_ids

• status - non-recurrent only; sets the status of the single task node

  • pending

  • in_progress

  • completed

  • cancelled

• observation - free-text; non-recurrent only

• schedule_frequency - recurrent only; must be provided together with schedule_interval

  • DAILY

  • WEEKLY

  • MONTHLY

  • YEARLY

• schedule_interval - integer; repeat every N periods (recurrent only); must be provided together with schedule_frequency

• schedule_days_of_week - comma-separated integers 1–7 (Mon=1, Sun=7), WEEKLY only

• schedule_weeks_of_month - comma-separated integers -1–4 (1=first, -1=last)

• schedule_months_of_year - comma-separated integers 1–12, YEARLY only

• schedule_end_date - date (YYYY-MM-DD)

• schedule_occurrences - integer; stop after N occurrences

• schedule_overdue_behavior

  • DELAY_NEXT

  • NO_IMPACT

Supported fields - per-template node sheets

Each sheet is named N-template name (truncated to 31 characters) and contains one row per past occurrence.

• due_date* - date (YYYY-MM-DD); rows with a future date are skipped automatically, rows with an invalid date are reported as errors

• scheduled_date - date (YYYY-MM-DD); defaults to due_date when blank

• status

  • pending

  • in_progress

  • completed

  • cancelled

• observation

Special considerations

• Folder is a fallback. Each row's folder column is resolved first; the domain selected in the wizard is only used when a row has no folder.

• Linked records are resolved within your accessible domains. assigned_to, assets, applied_controls, evidences and the assessment columns are matched by ref_id or name inside the domains you can access; an exact ref_id match wins, then an object in the row's own domain. Unresolved entries are skipped and reported as warnings, they will not block the import.

• Future nodes are skipped. Rows whose due_date is after today are ignored - those occurrences will be regenerated automatically from the schedule. Upcoming occurrences of an imported recurrent task are generated when the task is next opened or edited.

• Round-trip safe. Importing a fresh export works with the default Stop mode: the node auto-created for a non-recurrent task is updated by its node sheet instead of raising a conflict. Re-importing with Update mode overwrites existing task nodes and templates without creating duplicates. With Skip mode, existing records are left unchanged.

• Clearing relationships. In Update mode, leaving a relation column (e.g. assigned_to, assets) blank in the file clears the existing links on the template.

• Older exports. Files exported by previous versions numbered the node sheets differently; the importer re-matches those sheets by name and adds a warning when the sheet number and name disagree.

• CSV upload. A CSV file is accepted and imports the Summary sheet fields only; no task nodes are processed. The delimiter is detected automatically (comma, semicolon, tab or pipe).