Seven lessons from the NCSC Annual Review 2026, and the ISO 27001 evidence behind each
Marius van Aswegen
In short: The NCSC Annual Review 2026, published on 3 November, draws seven lessons from the 337 incidents it supported this year, and most of them come back to familiar weaknesses. We take each lesson, name the ISO 27001 Annex A controls that answer it, and set out the evidence an auditor would ask to see: the last three, and what happened to each.
The National Cyber Security Centre published its Annual Review 2026 on 3 November. It covers the year from 1 September 2025 to 31 August 2026, and the incident figures are worth pausing on. The NCSC received 1,831 reports of cyber attacks affecting organisations across a range of sectors. After triage, 337 of those became incidents that needed NCSC support, and 80 were classed as nationally significant. Separately, the Early Warning service notified around 8,500 organisations of events that indicated a suspected compromise of their systems.
Tucked inside the "Understanding the threat" section is a short chapter called "7 things we learned", drawn from those 337 incidents. Its summary line is the one we would put on the wall of every security team: most successful attacks continue to exploit familiar weaknesses.
Familiar weaknesses map to familiar controls. So in this instalment of our "Show me the evidence" series, we take each of the seven lessons, name the ISO/IEC 27001:2022 Annex A controls that address it, and then ask the question that matters in an audit room: what would we expect to see?
Lesson 1: Attackers exploit the basics
The NCSC says internet-facing assets remain a primary route to compromise, and that in many state-linked cases the vulnerabilities involved had patches available that had not been deployed quickly enough.
The controls here are A.8.8 Management of technical vulnerabilities, A.5.9 Inventory of information and other associated assets, and A.8.9 Configuration management. The evidence we ask for is the list of internet-facing systems, then the vulnerability scan results, and we check that every item on the first appears on the second. Then we ask for the last three critical vulnerabilities and the dates from public disclosure to fix. Where the fix was late or waived, we want to see the risk acceptance and who signed it.
Lesson 2: People remain the target
Social engineering and credential theft feature heavily in the review, and the NCSC's conclusion is that security culture matters. Its incident chapter also calls for wider adoption of passkeys in place of passwords.
Look at A.6.3 Awareness, education and training on information security, A.5.17 Authentication information and A.8.5 Secure authentication. Training completion rates tell us very little on their own. We ask for the last three phishing simulations, who clicked, and what happened to each of them afterwards. We ask for the multi-factor authentication coverage report, including the exceptions. And we ask how a member of staff reports a suspicious message, then look at the last three reports they actually made.
Lesson 3: State and criminal actors share weaknesses
The NCSC observes that hostile states and criminals use the same routes in: vulnerability exploitation and credential abuse. Poor cyber hygiene, in its words, creates opportunities for all threat actors.
This is where A.5.7 Threat intelligence earns its place alongside A.5.15 Access control and A.8.2 Privileged access rights. The evidence is not a subscription to a feed. It is the last three pieces of threat intelligence the organisation received and the decision made on each, whether that was a patch, a block, a rule change or a documented "no action needed". For privileged accounts, we ask for the most recent review, the accounts removed as a result, and the date.
Lesson 4: Ransomware remains highly disruptive
The review describes extortion, data theft, operational disruption and long recovery timelines. Its threat chapter cites Jaguar Land Rover's 2025 attack, with approximately £196 million in direct cyber-related costs and knock-on effects across its supply chain.
The relevant controls are A.8.13 Information backup, A.8.7 Protection against malware, A.8.22 Segregation of networks, A.5.29 Information security during disruption and A.5.30 ICT readiness for business continuity. A backup policy is not evidence of recovery. We ask for the last three restore tests, how long each took, what did not come back, and whether at least one copy is held somewhere an attacker with domain administrator rights could not reach. Then we ask when the business continuity plan was last exercised against a ransomware scenario, and what was changed afterwards.
Lesson 5: Preparation determines outcomes
The NCSC lists logging, monitoring, incident response planning and supply chain resilience as the things that separate a bad day from a very bad quarter.
Here we work through A.8.15 Logging, A.8.16 Monitoring activities, A.5.24 Information security incident management planning and preparation, and the supplier controls A.5.19 to A.5.23. The incident response plan should name roles and contact routes, and we want the record of the last exercise and the lessons captured. For logs, we ask how far back they go and who looked at them last week. For suppliers, we ask for the last three supplier reviews, the contract clause that requires incident notification, and whether the supplier has ever been asked to prove it.
Lesson 6: Early action reduces impact
The NCSC credits Early Warning notifications, faster detection and containment before escalation with keeping some incidents from ever needing its support.
A.8.16 Monitoring activities, A.5.26 Response to information security incidents and A.5.27 Learning from information security incidents apply. The first question is simple: is the organisation registered for Early Warning at all? If so, we ask for the last three notifications, the time from receipt to triage, and the decision taken. The incident log should show time to contain, not just time to close, and each closed incident should have a short note on what changed.
Lesson 7: Sophisticated actors do not need to be sophisticated to gain access
The final lesson is the most sobering. Initial access is often unremarkable. The sophistication shows in what the actor does once inside.
That points to A.8.22 Segregation of networks, A.8.20 Networks security, A.8.2 Privileged access rights and A.8.32 Change management. We compare the network diagram with what is actually configured. We ask what would alert if a standard user account started moving between systems at three in the morning. And we ask for the last three changes to perimeter or identity systems, who approved them, and whether anyone checked afterwards.
The question behind all seven
Tony the Auditor has one question, and it serves for every lesson above: show me the last three, and what happened to each. Policies describe intent. Records describe behaviour. The NCSC's 337 incidents are a reminder that attackers are reading the gap between the two.
If you would like to walk through these seven lessons against your own ISMS, book some time with us at hello@cybercontrols.io. We are also building an evidence library, control by control, which will appear in the Resources section of our site over the coming weeks.
