43filers, current period
13the period before
84controls it touches
44frameworks
The long view
Filings containing this phrase, every month since 2008. The last
point is the current month and is still filling, so it always looks lower than it will be.
2008
peak 98 in February 2023
2026
The long view
Filings containing this phrase, every month since 2008. The last
point is the current month and is still filling, so it always looks lower than it will be.
2008
peak 1,277 in February 2026
2026
In annual and quarterly filings the same phrase appears 879 times this quarter, against 826. A 10-K moves slowly: a company changing what it writes there has changed its mind about what is material, rather than reacting to one event.
Share this finding
Three times as many companies as last week. The card below carries the whole finding, so it makes
sense to somebody who never clicks through.
Who disclosed it
From SEC full-text search over 8-K filings. Every row links to the filing itself.
| Company | Form | Filed | |
|---|
| HANMI FINANCIAL CORP HAFC | 8-K | 2026-07-23 | filing |
| OLD DOMINION FREIGHT LINE, INC. ODFL | 8-K | 2026-07-23 | filing |
| PENSKE AUTOMOTIVE GROUP, INC. PAG | 8-K | 2026-07-23 | filing |
| Aether Holdings, Inc. ATHR | 8-K | 2026-07-21 | filing |
| VISTEON CORP VC | 8-K | 2026-07-23 | filing |
| Ameris Bancorp ABCB | 8-K | 2026-07-23 | filing |
| Albertsons Companies, Inc. ACI | 8-K | 2026-07-23 | filing |
| Rhinebeck Bancorp, Inc. RBKB | 8-K | 2026-07-23 | filing |
| HARLEY-DAVIDSON, INC. HOG | 8-K/A | 2026-07-23 | filing |
| TRICO BANCSHARES / TCBK | 8-K | 2026-07-23 | filing |
| SOUTHERN MISSOURI BANCORP, INC. SMBC | 8-K | 2026-07-22 | filing |
| MARSH & MCLENNAN COMPANIES, INC. MRSH | 8-K | 2026-07-21 | filing |
The full search on EDGAR
How it actually arrives
An 8-K's meaning is in its item number, not its text. These are the items the filings
containing this phrase were filed under. The first group is something that happened to the
company. The second is the phrase turning up in the ordinary course of reporting, most often in
an earnings release, which is a very different thing and is usually the larger number.
| Filed because something happened |
Companies |
|---|
| Other material event Item 8.01 | 53 |
| Director or officer departure Item 5.02 | 16 |
| Material cybersecurity incident Item 1.05 | 2 |
| Change of accountant Item 4.01 | 1 |
| Delisting or listing rule failure Item 3.01 | 1 |
| Bankruptcy or receivership Item 1.03 | 1 |
| Mentioned in routine reporting |
Companies |
|---|
| Financial statements and exhibits Item 9.01 | 188 |
| Entry into a material agreement Item 1.01 | 123 |
| Regulation FD disclosure Item 7.01 | 92 |
| Results of operations, the earnings release Item 2.02 | 66 |
| Completion of an acquisition Item 2.01 | 16 |
| Shareholder vote Item 5.07 | 7 |
This is why a headline count on its own overstates the case.
Where the routine number dominates, the phrase is being tracked as language rather than as
events.
Which industries file it
Companies grouped by the industry classification on their own filing. A count, not a
survey.
| Industry | | Companies |
|---|
| Banking | | 27 |
| Chemicals and pharmaceuticals | | 18 |
| Software and IT services | | 16 |
| Holding and investment offices | | 15 |
| Electronics and electrical equipment | | 11 |
| Industrial machinery | | 10 |
| Utilities | | 9 |
| Mining and extraction | | 8 |
| Transport equipment | | 8 |
| Services and entertainment | | 7 |
What it obligates
Our corpus holds 84 controls across
44 frameworks whose text speaks to this. Not a judgement:
these controls say so, and each is one lookup from its source document. Ordered by how much each
framework has to say about it, so the one that will cost you the most work is first. Every name
opens that framework in the corpus.
What an auditor will ask you to produce
The artefacts named on those controls, most frequently cited first.
- Pipeline + emerging risk readiness
- Multi-framework alignment + crosswalk
- FISMA reporting + CyberScope submission
- OMB Memo M-24-04 compliance
- FISMA 2.0 reform tracking
- Annual FISMA Report inclusion + agency score
- Backup policy
- Restoration test reports
How it usually fails
Recorded when each control was verified against its source. This is where programmes
that think they are covered turn out not to be.
- Pipeline not tracked
- International alignment weak
- Adoption monitoring weak
- Incomplete CMDB
- Multi-framework alignment ad-hoc
- FISMA reporting overdue or incomplete
Where this comes from
The left half is public record: SEC full-text search over 8-K filings, counted across a
7 day window against the equivalent window before it. You can check
every row.
The right half is ours: 723 frameworks and
20,473 controls, 531 of those frameworks verified against
their source documents, with the auditor evidence and common failure modes recorded control by
control. Controls appear here because their own text names this term.
Today's edition ·
How programmes fail ·
The obligation index