From a cyber finding to a named action
Assessments fail quietly when the report is treated as the outcome. The outcome is a decision: accept, fix, or change how the site operates. Each of those needs an owner who can actually make it.
For IT and OT estates, the owner is often split. A central team sets the standard. A site team lives with the consequence. The action has to name both, and it has to say whether the next step is a project, a technology change, or a recurring control.
If the finding cannot be placed on one of those paths, it is not ready to leave the assessment.