NSAuditor AI EE 0.32.7: One Network Scan Now Routes Findings Across All Seven Compliance Frameworks

NSAuditor AI EE 0.32.7 (with CE 0.2.32 and agent-skill 0.2.30) is live on npm. It ships two kinds of honesty in one release: a routing-integrity fix so a network finding carries into every framework that already maps it, and a capability-claim audit that withdrew six advertised capabilities with no implementation behind them. It is a matrix-neutral release — no new framework, no new plugin, and no coverage number moves.

The same scan, six clean reports it shouldn’t have been

A security finding should mean the same thing in every framework it touches. In the prior release, the network-scan analysis agents routed their findings to SOC 2 only. So a host serving cleartext or exposing SMB failed the SOC 2 report and read perfectly clean in the HIPAA, NIST CSF, ISO 27001, CIS v8, PCI DSS, and GDPR Article 32 reports produced from the same scan. That is exactly the false-clean a multi-framework tool exists to prevent.

We drove the real analysis agents over their full emission set and measured where the findings landed. 32 (source × framework × emission) cells reached zero controls in a framework that already mapped the agent. A cleartext service failed SOC 2 CC6.7 and vanished from the HIPAA §164.312(e)(1) report — a Required transmission-security standard — off an identical scan.

Forty-eight rules, each adjudicated — and twenty-four deliberately left alone

We did not bulk-copy the SOC 2 mappings across. Every cell was adjudicated under the matching auditor lens: HHS-OCR Required-vs-Addressable, NIST CSF Subcategory discipline, ISO/IEC 17021-1 Statement-of-Applicability framing, CIS Implementation-Group discipline, EDPB Article 32 sub-measure proportionality, and QSA cardholder-scope. 48 rules were added and 4 pre-existing wrong-control rules removed; 24 cells were deliberately left unrouted, each with a written per-framework justification (an aggregate open-port count is not a HIPAA access-control failure; an absent HSTS header is not an ISO configuration nonconformity). A cleartext channel now fails HIPAA §164.312(e)(1), ISO A.8.24, NIST PR.DS-02, CIS 3.10, PCI 4.2.1, and GDPR Art. 32(1)(a) — where those agents previously had no mapping at all.

A guard so it can’t silently regress

The drift detector that protected this class loaded SOC 2 and only SOC 2 — structurally blind to a finding that routes in SOC 2 and nowhere else. A new guard drives the real agents (never transcribed title strings, which go stale silently) and fails the build if any emission reaches zero controls in a framework that maps its source. An inversion invariant — absent encryption must fail a superset of what degraded encryption fails — caught two more cells the per-framework pass had left open. Both directions are mutation-proven.

One boundary, stated precisely: 16 of the 48 new rules are inert today because no scanner producer yet emits the TLS-quality fields (weak-protocol list, certificate expiry, response headers) they key on — that producer contract is the next cycle’s headline. 33 of the 48 fire now; the rest wait. We would rather name that than let a rule count imply coverage that isn’t live.

We audited our own capability claims — and cut the ones we couldn’t back

Preparing this release, we ran a claim audit over every advertised Pro/Enterprise capability. Several were marketed with no shipping implementation: a “Verification Engine” whose six modules were throw new Error('Not implemented') placeholders (and shipped in the package for a buyer to open); “branded reports,” “usage metering,” and per-scan “Docker isolation” with no code behind them; and a “ZDE policy engine” and “Enterprise CTEM datastore” that named no distinct engine.

0.32.7 withdraws all six — from the tier map, from the marketing, and from the licensing service that mints real customer licenses — fixed in lockstep across all four repositories that issue or expose a capability, and verified by decoding a freshly-minted key: it now asserts only capabilities that ship. Nothing real was removed. The code-enforced Zero-Data-Exfiltration read-only-credential guarantee, Pro-tier CTEM as unlimited scan-history retention, and the operator suppression workflow all ship and stay claimed. What isn’t yet built is now collected in an explicit Planned capabilities table, and the stub files no longer ship (the package dropped from 100 to 94 files).

Where it’s validated

These detections live on the analysis-agent (network-scan) path, not the cloud-scan path — so a scan_cloud prompt does not exercise them. The release is validated by the unit suite (9025 pass / 0 fail, routing proven end-to-end and mutation-checked) plus a live network scan, and the capability removal by decoding a real minted license from the deployed service.

All seven coverage matrices are unchanged (SOC 2 10/4/33 · HIPAA 7/3/45 · NIST 13/10/83 · PCI 19/9/39 · ISO 17/14/62 · CIS 17/23/113 · GDPR Art. 32 4/5/2). Learn more at the NSAuditor AI Enterprise page.