Compliance drift report, October 2026: 55 of the top 2,000 vendors carry a lapsed PCI DSS row, BAA coverage and registry mix across 8,067 vendors

This report reads the CertReports index as of 26 Oct 2026: 15,529 public evidence rows across 8,067 B2B software vendors, drawn from 10 sources. It measures drift: how much public compliance evidence lapsed, how old it is, and how coverage differs by framework and category. Every figure below is computed from stored rows, dated, and reproducible.

3.2%

of evidence rows are past their date

503 of 15,529 rows

0%

of DPF listings linked to vendors have lapsed

0 lapsed, 1,618 active

2.8%

of the top 2,000 vendors carry a lapsed PCI DSS row

55 of 1,981 vendors by demand rank

Lapse rates by framework

A row lapses when its own evidence says so: a certificate expiry, a report period plus twelve months, a registry usage end date, a registry validation date plus twelve months, or a dated registry withdrawal. Active rows are verified or stated rows whose date has not passed. Registry records marked inactive that carry no date at all (3,466 rows, almost all historical Data Privacy Framework and Privacy Shield participants) are counted separately and left out of every lapse share, because they describe the list's history rather than drift in the period.

The top 2,000 vendors

The 2,000 highest-demand vendors in the catalogue (1,981 active) are the ones most reviews touch. This table asks a narrower question than the one above: how many of them carry at least one lapsed row per framework.

Evidence age

Days between the capture date of each row and 26 Oct 2026. Registries are re-read nightly, so registry rows stay young; vendor-stated rows age until the page is captured again.

HIPAA BAA coverage by category

Share of indexable vendors in each category with a public business associate agreement offer. There is no HIPAA certification; the offer is the public artefact.

FedRAMP status mix

Statuses as published in the Marketplace data file at the last sync, plus vendor-stated rows from trust centres. Under the Consolidated Rules for 2026 the official label is "FedRAMP Certified"; rows carry the text the file published.

Data Privacy Framework usage end

1,618

Active DPF listings linked to vendors

0

Past their usage end date

0.0% of active plus lapsed

363

Usage end dates in the next 90 days

3,464

Inactive listings with no usage end date

historical participants, excluded from the lapse share

Drift index

The drift index is the number of rows that lapsed or were removed in a month per 1,000 active rows. It is the time series behind the change log; the first observed month is September 2026, when the index went live, so the series is short and will lengthen with each report.

Events in the period

Trust reports behind the numbers

No high-demand vendor's evidence lapsed in October 2026. These are the highest-demand vendors with evidence due to lapse within 90 days of 26 Oct 2026. Each card is read live from the index, so it shows any renewal captured after the report was generated; the caption keeps the fact the report counted.

Google · Trust report

Cloud and hosting · Public evidence as of 26 Oct 2026

Visit google.comFull evidence

Framework overview

CertReports state for each framework with public evidence: 5 verified.

• PCI DSSVerifiedValid to 31 Mar 2027
• FedRAMPVerifiedHigh impact
• CSA STARVerifiedCSA STAR registry · 26 Oct 2026
• DPFVerifiedValid to 12 Jan 2027
• DORA CTPPVerifiedofficial registry · 26 Oct 2026
• SOC 2ReportedType II report

network · Trust report

Public evidence as of 26 Oct 2026

Visit network.globalFull evidence

Framework overview

CertReports state for each framework with public evidence: 1 verified.

• PCI DSSVerifiedValid to 31 Dec 2026

Method and sources

• Registry rows: FedRAMP Marketplace data file, Data Privacy Framework participant list, Visa Global Registry of Service Providers, CSA STAR registry, mirrored nightly.
• Vendor-stated rows: trust centres and security pages captured with a content hash and capture date.
• Lapse: expiry date, period end plus twelve months, usage end date, validation date plus twelve months, or withdrawal.
• Top 2,000: vendors ranked by demand in the CertReports catalogue.
• Drift index: (lapsed + removed) in the month divided by active rows at generation, per 1,000.
• Generated 26 Oct 2026. Figures for a closed month are frozen when the month ends; the current month is refreshed daily.