Compliance drift report, September 2026: 69% of DPF listings lapsed, BAA coverage and registry mix across 3,000 vendors

This report reads the CertReports index as of 18 Sep 2026: 8,228 public evidence rows across 3,000 B2B software vendors, drawn from 6 sources. It measures drift: how much public compliance evidence lapsed, how old it is, and how coverage differs by framework and category. Every figure below is computed from stored rows, dated, and reproducible.

44.3%

of evidence rows are past their date

3,645 of 8,228 rows

69%

of DPF listings linked to vendors have lapsed

3,455 lapsed, 1,585 active

29.6%

of the top 2,000 vendors carry a lapsed EU-US Data Privacy Framework row

586 of 1,981 vendors by demand rank

Lapse rates by framework

A row lapses when its own evidence says so: a certificate expiry, a report period plus twelve months, a registry usage end date, a registry validation date plus twelve months, or a registry withdrawal. Active rows are verified or stated rows whose date has not passed.

The top 2,000 vendors

The 2,000 highest-demand vendors in the catalogue (1,981 active) are the ones most reviews touch. This table asks a narrower question than the one above: how many of them carry at least one lapsed row per framework.

Evidence age

Days between the capture date of each row and 18 Sep 2026. Registries are re-read nightly, so registry rows stay young; vendor-stated rows age until the page is captured again.

HIPAA BAA coverage by category

Share of indexable vendors in each category with a public business associate agreement offer. There is no HIPAA certification; the offer is the public artefact.

FedRAMP status mix

Statuses as published in the Marketplace data file at the last sync, plus vendor-stated rows from trust centres. Under the Consolidated Rules for 2026 the official label is "FedRAMP Certified"; rows carry the text the file published.

Data Privacy Framework usage end

1,585

Active DPF listings linked to vendors

3,455

Past their usage end date

68.6% of linked listings

356

Usage end dates in the next 90 days

Drift index

The drift index is the number of rows that lapsed or were removed in a month per 1,000 active rows. It is the time series behind the change log; the first observed month is September 2026, when the index went live, so the series is short and will lengthen with each report.

Events in the period

Method and sources

• Registry rows: FedRAMP Marketplace data file, Data Privacy Framework participant list, Visa Global Registry of Service Providers, CSA STAR registry, mirrored nightly.
• Vendor-stated rows: trust centres and security pages captured with a content hash and capture date.
• Lapse: expiry date, period end plus twelve months, usage end date, validation date plus twelve months, or withdrawal.
• Top 2,000: vendors ranked by demand in the CertReports catalogue.
• Drift index: (lapsed + removed) in the month divided by active rows at generation, per 1,000.
• Generated 18 Sep 2026. Figures for a closed month are frozen when the month ends; the current month is refreshed daily.