You have been told to adopt something
Name what you already run and what you have been told to do. You get the overlap control by
control, and the list that is genuinely new work. The answer normally costs a five figure
gap assessment.
Measure the overlap
You want to know what a standard requires
723 frameworks, every control in each, how many other
standards carry the same control, and the evidence an auditor asks for against it.
342 have an implementation kit.
Look up a framework
Start with one you already run
Below: what public companies actually disclosed this week, and which obligations
those disclosures activate. That part changes every morning.
88 companies now disclose AI Governance. Last quarter it was 21.
364disclosures, past 7 days
75of them since yesterday
7phrases moved sharply
0events naming an obligation
20,473controls they land on
What happened yesterday
FDCTECH, INC. has filed with the SEC since 2022.
This week it used a phrase it had never used before.
The phrase was material weakness. On 22 September, after 4 years of filings
that never mentioned it, it appeared. 4,261 other public companies had written it
down first.
Nobody puts a phrase like that into a filing casually. It goes through legal. It goes on the
record. Every competitor and every regulator can read it, and it cannot be taken back. Somewhere
in that company, an argument that had been running for years ended this week.
Disclosing it is one paragraph. Proving it is the rest of somebody's year.
Here is the part that does not appear in the filing. The moment that phrase is on the record, it maps to obligations within COSO Internal Control, an instrument with 27 controls behind it. None of that is a count of companies. It is a list of things somebody now has to evidence rather than assert.
And almost nobody notices the next bit. 25 of those same controls are already most of COBIT 2019. The work counts twice. Most organisations do it twice instead, because no one ever told them the mapping existed.
The filing, the company, and the 4,262 others who got there first:
FDCTECH, INC. ·
Material Weakness
What companies disclosed this week
Public companies writing each phrase into an 8-K in the last seven days, against the seven days before, and how many of those arrived since yesterday. An 8-K must be filed within four business days of the event, so this is the fastest signal in the set. Ordered by how surprising each change is at the size it happened, so a swing of sixty-nine companies out of five hundred outranks seven out of three. Every row opens the filers and what it obligates.
Today's hidden connection
ASD Strategies to Mitigate Cyber Security Incidents already covers 46% of NIST SP 800-66 Rev 2
30 of 65
Two standards written by different bodies, for different reasons, at different times. Nobody
plans a programme around both. 30 of NIST SP 800-66 Rev 2's 65 controls are already satisfied by controls
inside ASD Strategies to Mitigate Cyber Security Incidents.
If you hold one of these and are scoping the other, that is the difference between a project
and a gap assessment. Almost nobody checks, because checking requires a mapping that has to be
built by hand, control by control.
See exactly which controls overlap →
Today's historical parallelAlgorithmic Bias is following the curve Climate Related Disclosure followed three years ago
92% shape match
Both went from almost nothing to a steady presence over the same span of months. Climate Related Disclosure peaked at 145 companies in a month and has stayed there.
Nothing here says the second will end where the first did. It says the shape of the first three years is the same shape, and the people who acted on the earlier one had two years of warning that everybody else read as noise.
The failure of the day
No clear accountability for innovation outcomes
6 separate frameworks warn about this, across 13 controls.
Different standards bodies, different countries, different industries, written years apart by
people who never spoke to each other, among them ISO 22313:2020, ISO 37002:2021, ISO 39001:2012.
When one framework flags something, it is an opinion. When 6
arrive at it independently, it is not a preference you can argue with. It is what actually
happens.
When an auditor finds it, this is what they ask you to produce:
- Board minutes referencing innovation strategy
- Executive innovation charter
- Innovation council terms of reference
- RACI for innovation roles
Could you put your hands on those
4 by Friday? That question, not the definition above, is the one worth sitting
with.
Who warns about it, and what closing it also
moves →
Today's risk shiftAi Governance moved more than anything else we track
+319%
From 21 companies to 88 in a week. Not a survey and not a forecast: a count of public companies choosing to put the phrase into a filing.
Ranked by how surprising the change is at the size it happened, so a swing of sixty out of five hundred does not outrank seven out of nine.
Today's industry patternAgriculture, forestry and fishing talks about restatement more than anything else it discloses
17.7%
17.7% of everything this industry writes into our tracked topics is this one phrase. 39 companies, out of 220 topic mentions across the industry.
An industry concentrating on one disclosure is telling you where its regulator is looking. It is also telling every competitor in it what the table stakes now are.
Today's framework explainedISO 27017:2015
86 controls, verified against the source document, issued for International.
Its controls are not confined to it. 30 of them appear again inside ISO 27701:2019, 23 of them appear again inside ISO 27018:2019, 8 of them appear again inside ISO 19011:2018.
Which is the part nobody plans for: adopting this is partly adopting those.
Today's executive decisionAsk for the Communication plan (internal/external)
6 frameworks independently warn about IP register incomplete, ownership disputes likely. When an auditor goes looking for it, this is the first thing they ask to see.
You do not need to read the standard to run this test. Ask for it in tomorrow's meeting and watch how long it takes to arrive. The delay is the finding.
And in annual and quarterly filings, year on year
The same phrases in 10-K and 10-Q filings, this quarter against the same quarter last year, most surprising change first. Slower and less noisy than the 8-K table: a company changing what it writes in a 10-K has changed its mind about what is material.
| Disclosure | This quarter | Change | Named |
|---|
| AI Governance | 88 | +67 filers, +319% | 16 named |
| Business Continuity | 701 | +129 filers, +23% | 16 named |
| Privacy Compliance | 119 | +41 filers, +53% | 16 named |
| Data Governance | 100 | +37 filers, +59% | 16 named |
| Operational Resilience | 99 | +33 filers, +50% | 14 named |
| Climate Related Disclosure | 55 | +20 filers, +57% | 16 named |
| Algorithmic Bias | 14 | +9 filers, +180% | 14 named |
| Artificial Intelligence Risk | 10 | +6 filers, +150% | 9 named |
| ESG Reporting | 15 | -10 filers, -40% | 13 named |
| Third Party Risk Management | 81 | +18 filers, +29% | 16 named |
| Regulatory Reporting | 208 | +23 filers, +12% | 16 named |
| Ransomware | 907 | +46 filers, +5% | 11 named |
| Internal Control Over Financial Reporting Material Weakness | 6 | -4 filers, -40% | 6 named |
| SOC 2 | 73 | +11 filers, +18% | 6 named |
| Audit Committee Oversight | 36 | +7 filers, +24% | 16 named |
| Vendor Risk Management | 13 | +4 filers, +44% | 13 named |
| Whistleblower Program | 27 | -5 filers, -16% | 16 named |
| Model Validation | 22 | +3 filers, +16% | 16 named |
| Cybersecurity Incident Disclosure | 3 | small numbers either way | 3 named |
| Data Residency | 40 | +3 filers, +8% | 16 named |
| Records Retention | 28 | -2 filers, -7% | 16 named |
| Identity And Access Management | 28 | +1 filers, +4% | 16 named |
| Cross Border Data Transfer | 131 | +2 filers, +2% | 16 named |
What else moved
Regulator notices, incidents, research and industry news from the last
30 hours that name an obligation in the corpus. Ordered by whether the item is an
event or a comment on one. Not a score: a sort.
Nothing outside the filings named an obligation today.
How this page is made
The disclosure counts come from SEC full-text search over 8-K filings, counted across the
last seven days against the seven before, with the filers named. The window slides a day every
morning, so today's number is not yesterday's. Public record, and every number is one click
from the filing.
The tables are ordered by how far apart the two counts are
relative to the variation you would expect at that scale, which is the standard comparison for
count data. Percentage alone would put a three-to-ten move above a five-hundred-and-seventy-
three-to-six-hundred-and-forty-two move; volume alone would show the same large topics every
day and never show anything moving. Both numbers that drive the ordering are printed on every
row so it can be checked by eye.
What each disclosure obligates comes from our corpus:
723 frameworks and 20,473 controls,
531 frameworks verified against their source documents. A control appears
against a theme because its own text names it, so "why is that on the list" always has a
checkable answer.
298 further items were read today. Those naming no obligation
are counted rather than hidden, because a page that only ever shows hits is not measuring
anything. Nothing here is generated, predicted or scored.
Today's edition, permanently ·
First detected ·
How much of that do you already have? ·
How compliance programmes fail ·
The obligation index ·
Unmet demand ·
What we killed