How we measure trends

1. What we actually measure

Every figure on the trends page comes from one signal: page views of the public directory pages on ismsdirectory.com. Nothing else feeds it.

• It is page views only - not searches, not directory submissions, not survey responses, not buyer enquiries, and not vendor-reported sales.
• We use our own self-hosted, privacy-respecting analytics. We do not sell it, and we do not run third-party advertising trackers on these pages.
• It is aggregate counts only. No personal data is shown, no individual visitor is identified, and no submitter or company is named.

2. What a "region" actually means

This is the most important caveat. A region is taken from the URL of the directory page that was viewed - not from the visitor's location. We do not geolocate visitors by IP, and we do not ask anyone where they are.

Concretely: "Rising interest for SOC 2 in France" means the SOC 2 × France directory page was viewed more in the last period than the one before. The people viewing it could be anywhere - a US startup researching auditors, a vendor checking their listing, a job-seeker, a crawler, or our own SEO traffic. It is not evidence that companies based in France are adopting SOC 2.

3. How frameworks and regions are matched

The framework and region are read from the page path against a fixed list of known frameworks and regions. Pages outside that list are ignored, and any path we cannot confidently classify is dropped rather than guessed. So the trends only cover frameworks and regions that already have dedicated directory pages.

4. Time window and sample size

We only started collecting this data in mid-March 2026. That is a short history at low absolute volume. Treat early movements as directional at best, not as a market study.

Growth compares a period against the immediately preceding period of equal length. Because the numbers are small, a handful of extra views can read as a large percentage. So below a small view threshold we deliberately do not show a growth figure or call something "rising" - we label it "low data" instead of inventing a trend.

5. What this is not

• Not market research or a representative survey of compliance buyers.
• Not verified purchase intent, budget, or adoption.
• Not in-country demand - see the region caveat above.

There is a known skew: this is an English-language directory, so traffic leans toward internationally-facing startups and SMEs shopping for SOC 2 and ISO 27001. That is not the same population as, for example, established French firms whose effort may be going to NIS2 or national schemes. The trends reflect who reads our pages, not the whole market.

6. Why we publish it anyway

Read for what it is - what the GRC-curious audience reaching this directory is currently looking into - it is a useful, honest signal. Read as a verdict on a national market, it would be wrong, and we would rather you knew the difference than be impressed by a number.