Lessons from the front line.

On 3 November 2026, the National Cyber Security Centre published its Annual Review.

One of its central messages is that “most successful attacks continue to exploit familiar weaknesses”, among them “known vulnerabilities” and “poorly secured systems”. It also notes that “internet-facing assets remain a primary route to compromise”.

The review also contains a line about what happens next:

“The challenge is no longer identifying risks to the UK’s most critical organisations; it is acting on them.”

What the NCSC said

That line in the review is about the UK’s most critical organisations. The review’s advice to boards and executives is written with them in mind. It says they should seek assurance not only that policies exist but that they can demonstrate measurable improvements in preparedness, recovery capability and resilience outcomes. It adds: “This requires more than compliance.”

Most smaller organisations are not in that group. In Amana’s view, the underlying point still applies to them: identifying a weakness and fixing it are separate pieces of work, and the second is often the one that stalls.

Where the gap appears in smaller organisations

A Cyber Essentials assessment, a penetration test or an IT provider’s report can identify weaknesses that need attention. The difficulty comes afterwards. The report is read, a few quick fixes are made and the rest sits in an inbox or someone’s personal document. Months later, it can be difficult to establish what was fixed, what was deferred and what remains unresolved.

A list of findings only reduces risk once someone acts on it. For a smaller business, the practical test is whether an owner or director can say what was found, what was done and what is still open.

A simple way to track findings to completion

The following approach is Amana’s own advice, not NCSC guidance. It needs nothing more than a shared spreadsheet.

1. Keep one list. Record findings from assessments and other relevant sources in one place, with the date, where each came from and a plain-language description of what could go wrong.
2. Give each finding one owner. This is a named person responsible for seeing it through, even if an IT provider does the technical work.
3. Prioritise by impact on the business. A technical severity rating is a useful input, but it does not say what would happen to your organisation. Ask what would stop working, what information could be exposed and how easily the weakness could be exploited.
4. Decide what happens next, and record it. Each finding needs a clear outcome: an action with a deadline, a documented decision to accept the risk, or a reason why no further action is required. Record who in the organisation made the decision and when it should be reviewed. A finding with no agreed outcome is easy to forget and hard to account for.
5. Check that the fix worked. Being told that something is done is not the same as knowing the weakness has been addressed. Ask for appropriate evidence, such as a configuration record, a rescan or a test result. Where necessary, arrange independent verification before closing the finding.
6. Review the list regularly, such as monthly, with the person accountable for the outcome.

If an IT provider manages the system

Where a provider looks after your systems, the same list applies. After an assessment, it is worth asking:

1. Which findings are yours to fix, and which require decisions or access from us?
2. What has been completed and what remains outstanding?
3. When will the remaining work be done?
4. What evidence can you provide that the changes resolved the weaknesses?
5. Which risks need a decision from us and when should they be reviewed?
6. How will we verify that the agreed work has been completed?

A provider can carry out the technical work and provide evidence. However, in Amana’s view, the organisation must retain responsibility for deciding which risks it is prepared to accept and for ensuring that agreed actions have been completed.

Sources: NCSC, Annual Review 2026, “A moment of choice”, 3 November 2026; NCSC, Annual Review 2026, “7 things we learned”, 3 November 2026.