Are you hungry? A two-part blog about risk appetites - NCSC.GOV.UK

NCSC blog - NCSC.GOV.UK

Cyber Security Toolkit for Boards - NCSC.GOV.UK

Find an assured Cyber Incident Response provider - NCSC.GOV.UK

Search assured providers - NCSC.GOV.UK

Recovering a hacked account - NCSC.GOV.UK

Report a scam website - NCSC.GOV.UK

AIT fraud: what you need to know - NCSC.GOV.UK

Principle B: Strategy - NCSC.GOV.UK

Protecting bulk personal data - NCSC.GOV.UK

Lists of related items should be written [semantically](https://html.com/semantic-markup/) as a 
list.

Usually this means rewriting these to use the `<ul>` or `<ol>` tags.

This allows assistive technologies to more easily navigate from item to
item, or past entire groups of links if the user wants to. 

## Examples 

### Navigation

This navigation:

```html
<a href="/about">About us</a>
<a href="/products">Products</a>
<a href="/contact">Contact us</a>
```

Should be rewritten as a list:

```html
<ul>
  <li><a href="/about">About us</a></li>
  <li><a href="/products">Products</a></li>
  <li><a href="/contact">Contact us</a></li>
</ul>
```

### Tables for content

This single-column table is redundant. There is no
value in placing the content in a table, which makes
it harder for screen reader users to interpret and interact
with.

```html
<table>
  <tr>
    <td>
      Banana
    </td>
  </tr>
  <tr>
    <td>
      Apple
    </td>
  </tr>
  <tr>
    <td>
      Pear
    </td>
  </tr>
</table>
```

Should be rewritten as a list:

```html
<ul>
  <li>Banana</li>
  <li>Apple</li>
  <li>Pear</li>
</ul>
```

## Justification

Users of assistive technologies, like screen readers, can skip an entire
list in one step. In some cases, they can even search inside a list. 

These aids are not available where links are written outside a list. 
Failing to use lists correctly can force users to have to step through
hundreds of items one at a time.

## Methodology

1. Any single-column tables are automatically considered 
   redundant lists. 
2. For non-table elements, recursively work down the page looking inside
   each element for links separated by minimal amounts of non-link text. 
   If the non-link text is below 30 characters 
   in length, we assume we're inside content that should be a list.
   Some exceptions are made, e.g. the presence of an `<hr>` would break
   out of the list.

## More information

See [Technique
H48](https://www.w3.org/TR/2016/NOTE-WCAG20-TECHS-20161007/H48) for
details.

mark-navigation-section-as-list

January 2026

December 2025

The National Cyber Security Centre

Title / URL	Issues
Are you hungry? A two-part blog about risk appetites - NCSC.GOV.UKwww.ncsc.gov.uk/blog-post/a-two-part-blog-about-risk-appetites	2
NCSC blog - NCSC.GOV.UKwww.ncsc.gov.uk/section/keep-up-to-date/ncsc-blog	2
Cyber Security Toolkit for Boards - NCSC.GOV.UKwww.ncsc.gov.uk/collection/board-toolkit	2
Find an assured Cyber Incident Response provider - NCSC.GOV.UKwww.ncsc.gov.uk/schemes/cyber-incident-response/find-a-provider	2
Search assured providers - NCSC.GOV.UKwww.ncsc.gov.uk/section/products-services/search?sort_key=0.25696862728242853	2
Recovering a hacked account - NCSC.GOV.UKwww.ncsc.gov.uk/guidance/recovering-a-hacked-account	1
Report a scam website - NCSC.GOV.UKwww.ncsc.gov.uk/collection/phishing-scams/report-scam-website	1
AIT fraud: what you need to know - NCSC.GOV.UKwww.ncsc.gov.uk/blog-post/ait-fraud-what-you-need-to-know	1
Principle B: Strategy - NCSC.GOV.UKwww.ncsc.gov.uk/collection/board-toolkit/principle-b-strategy	1
Protecting bulk personal data - NCSC.GOV.UKwww.ncsc.gov.uk/collection/protecting-bulk-personal-data	1

Write lists or groups of links semantically

The National Cyber Security Centre

Where this issue has occurred