1. Load both workbooks

Both files need a sheet named Template. Other tabs are ignored.

Required

Rev 5 export

The new export with unassessed CCIs

Required

Rev 4 export

The old export holding your results

Header row is detected automatically — override it here if it guesses wrong

The header row is the one containing CCI, AP Acronym, Compliance Status and so on — data starts on the row below it. Leave these blank unless the detected row shown in the summary is wrong.

Rev 5 header row Rev 4 header row

Some workbooks carry two sets of identically-titled columns — Compliance Status, Date Tested, Tested By and Test Results appear twice, because someone deleted one set and a replacement was added to the right. When that happens the tool reads from the last set in Rev 4 and writes into the first set in Rev 5. Override that here by typing which set to use (1 = leftmost). The summary always shows the column letters it settled on.

Rev 5 status column set Rev 4 status column set

2. Validation summary

Check these before you trust either output file.

Rev 5 input

Expansion — one row per CCI

Match against Rev 4

Re-aggregation — one row per AP acronym

Resolved compliance status, by AP acronym — click to expand

CCIs appearing more than once — click to expand

A CCI can be assessed under more than one assessment procedure, so the same CCI legitimately appears under several APs. Each one receives the same Rev 4 result. If a CCI repeats within a single AP, that is more likely a duplicate row in the export than a genuine reuse — worth a look.

Unmatched CCIs — click to expand

Columns detected in each workbook — click to expand

3. Download

The expanded file is the auditable one — every CCI on its own row, showing exactly what carried forward and what didn't. Hand it to the ISSO, ISSM or SCA. The import-ready file is the same data re-aggregated to one row per AP acronym, shaped for upload back into eMASS. It is your original Rev 5 file with only columns N–Q rewritten — the classification banner, the merged header rows, column widths, formatting and every other tab are left exactly as eMASS produced them.

How it works

Expand. Rev 5 packs several CCIs into one cell, separated by semicolons. Each becomes its own row; every other column is copied across unchanged.
Match. Each CCI is looked up in the Rev 4 workbook and its Compliance Status, Date Tested, Tested By and Test Results are pulled over. Columns are found by header name, so the two workbooks don't need matching layouts. If a workbook carries the same header twice — which happens when a column set was deleted and a replacement added to the right — Rev 4 is read from the last set and Rev 5 is written to the first. The summary shows which column letters were used, and the override panel lets you force a different set.
Tag. Test Results gets its CCI stamped on the front, so after re-aggregation you can still tell which CCI said what.
Re-aggregate. Rows are grouped back together on AP acronym and one compliance status is resolved for the whole AP. In the import-ready file, CCI and CCI Definition are restored to the exact packed strings eMASS exported — only the four assessment columns carry new data, so the file round-trips cleanly.

The status rule is a judgment call — make sure it's yours. When one AP has several CCIs with different results, this tool resolves them as follows:

Any CCI Non-Compliant → the AP is Non-Compliant
Not Applicable with no Compliant and no Non-Compliant → Not Applicable
Otherwise, any Compliant → Compliant
Nothing matched at all → Unassessed, left in deliberately so you can see it and decide

Date Tested and Tested By follow the status. When an AP has several CCIs with different results, these two columns are taken from the CCI that drove the resolved status — so a Non-Compliant AP carries the date and tester of the non-compliant finding, not of an earlier compliant one. If that CCI has no date recorded, the first non-empty date in the group is used instead. The per-CCI dates are all preserved untouched in the expanded file.

That is the conservative reading, and it is not the only defensible one. Some assessors would not let a single unassessed CCI drag a whole control down; others would. Review the expanded file and change what your SCA expects before you import anything.

Check the output before you import it. This tool is offered free and without warranty. It changes compliance statuses in a file you are going to upload to an authorization record. Open both downloads, compare the counts above against your own, and spot-check a handful of controls. You are responsible for what you submit.