Ransomware

The long view, in 8-K filings

An 8-K is filed within four business days of an event, so this counts filings made because something happened. Every month since 2008. The last point is the current month and is still filling, so it always looks lower than it will be.

The long view, in annual and quarterly filings

A 10-K or 10-Q is a periodic report, so this counts how often the phrase appears in routine annual and quarterly reporting. It moves far more slowly and the numbers are larger. Every month since 2008. The last point is the current month and is still filling, so it always looks lower than it will be.

In annual and quarterly filings the same phrase appears 907 times this quarter, against 861. A 10-K moves slowly: a company changing what it writes there has changed its mind about what is material, rather than reacting to one event.

Who disclosed it

From SEC full-text search over 8-K filings. Every row links to the filing itself.

The full search on EDGAR

Who is hiring for it

A sample of the open roles naming this phrase. An employer paying a salary against something is the least ambiguous demand signal there is, and every row links to the posting so the claim can be checked rather than believed. The total above is the whole US market; these are the ones we hold the posting for.

How it actually arrives

An 8-K's meaning is in its item number, not its text. These are the items the filings containing this phrase were filed under. The first group is something that happened to the company. The second is the phrase turning up in the ordinary course of reporting, most often in an earnings release, which is a very different thing and is usually the larger number.

This is why a headline count on its own overstates the case. Where the routine number dominates, the phrase is being tracked as language rather than as events.

Which industries file it

Companies grouped by the industry classification on their own filing. A count, not a survey.

What it obligates

Our corpus holds 84 controls across 44 frameworks whose text speaks to this. Not a judgement: these controls say so, and each is one lookup from its source document. Ordered by how much each framework has to say about it, so the one that will cost you the most work is first. Every name opens that framework in the corpus.

What an auditor will ask you to produce

The artefacts named on those controls, most frequently cited first.

• Pipeline + emerging risk readiness
• Multi-framework alignment + crosswalk
• FISMA reporting + CyberScope submission
• OMB Memo M-24-04 compliance
• FISMA 2.0 reform tracking
• Annual FISMA Report inclusion + agency score
• Backup policy
• Restoration test reports

How it usually fails

Recorded when each control was verified against its source. This is where programmes that think they are covered turn out not to be.

• Pipeline not tracked
• International alignment weak
• Adoption monitoring weak
• Incomplete CMDB
• Multi-framework alignment ad-hoc
• FISMA reporting overdue or incomplete

What this obligates

The instruments in our corpus that govern this disclosure, and how many controls sit behind each. This is not a filing count. It is what applies once a company has written the phrase down.

5 frameworks, 374 controls between them.

What closing it also moves

The same controls appear in other frameworks through mappings held in our corpus. Work done here is already progress there. This is the part that is not in EDGAR and not in any public dataset: it comes from mappings built and verified by hand, control by control.

Counted as controls reached through cross-framework mappings. It measures overlap of work, not compliance with the named framework.

Today's edition · How programmes fail · The obligation index