Auditor-Verifiable Evidence: NSAuditor AI Enterprise 0.33.1 Puts RFC 3161 Trusted Timestamps in All Seven Framework Reports

Every pre-audit evidence pack carries an unspoken asterisk: trust the tool that produced it. Sooner or later an assessor asks the question that asterisk cannot survive — how do I know this file was not edited after the scan? — and at most tools the honest answer is a support ticket.

Nsasoft US LLC has released NSAuditor AI Enterprise 0.33.1, alongside Community Edition 0.2.38 and agent-skill 0.2.36, and the change is aimed squarely at the person who reads the output rather than the person who runs the scan: all seven auditor-shaped compliance reports now state, in the document itself, how every artifact in the pack can be made independently verifiable.

The claim, and how an assessor checks it

NSAuditor AI Enterprise supports RFC 3161 trusted timestamping as an opt-in capability. An operator points the NSAUDITOR_TSA_URL environment variable at a Time-Stamp Authority of their own choosing, and every compliance artifact the scan produces — the framework report, the cover-page scope attestation and the chain of custody — is written alongside an RFC 3161 .tsr sidecar.

The verification procedure is the part that matters to an assessor, because it does not involve the vendor at all:

$ openssl ts -verify -data scan_compliance_soc2.json \
    -in scan_compliance_soc2.json.tsr \
    -CAfile <tsa-ca>.pem -untrusted <tsa>.crt

Verification: OK

That check runs offline, against a third party, with no NSAuditor software anywhere in the path. It is the only form of evidence integrity an outside reviewer has no structural reason to take on trust.

The negative control is the interesting half

An OK on its own proves only that a command ran. On 7 August 2026, exercised end to end through the published npm binaries against a real public Time-Stamp Authority, the same procedure returned Verification: OK on the compliance report, the scope attestation and the chain of custody — and Verification: FAILED after a single byte was appended to one of the artifacts.

The failure is what converts a passing command into a statement about those exact bytes, at that exact moment. Assessors who have spent time with vendor integrity claims will recognise the difference immediately.

Opt-in, with no default — deliberately

NSAUDITOR_TSA_URL has no default value, ever. Unset means the capability is absent, not “use the vendor’s authority”. A timestamp is an outbound call to a third party, and Nsasoft treats that as the operator’s decision rather than a convenience made on their behalf; an air-gapped environment simply leaves the variable unset, and nothing is timestamped and nothing is sent. The capability requires the openssl binary on the scanning host, and it is refused outright when the product is configured for offline-only operation — because an offline posture and a named outbound destination are a contradiction the product treats as a startup error rather than a quiet downgrade to weaker evidence.

One answer, on every surface a reader can reach

What 0.33.1 adds is consistency across the surfaces an evaluator actually opens. The seven framework reports, the agent-skill package an AI assistant loads, and the Community Edition README now describe the capability the same way. For teams whose assessors, security questionnaires and internal AI assistants all query different artifacts, that single-answer property is worth as much as the capability itself.

What is unchanged

0.33.1 is a matrix-neutral release. All seven coverage matrices are unchanged — SOC 2 (AICPA TSC), HIPAA Security Rule §164.312, NIST CSF 2.0, PCI DSS v4.0.1, ISO/IEC 27001:2022, CIS Controls v8 and GDPR Article 32 infrastructure substrate. The plugin catalogue is unchanged at 28 Enterprise plugins — 27 cloud auditors across AWS, Azure and GCP plus one Zero Trust posture assessment scored from a network-host scan — and 55 in total with Community Edition’s 27.

A single command across all three clouds with all seven frameworks enabled evaluates 1,608 controls and returns seven auditor-shaped reports, not one report relabelled seven times. Scanning is agentless and uses read-only credentials, and the always-on evidence-integrity layer remains the SHA-256 chain of custody, with the RFC 3161 timestamp as an optional third-party addition on top of it.

Availability

Community Edition is free and MIT-licensed on npm as nsauditor-ai. Enterprise Edition ships as @nsasoft/nsauditor-ai-ee, is licensed per seat, and is also available through AWS Marketplace. Enterprise 0.33.1 requires Community Edition 0.2.37 or newer.

Product details: https://www.nsauditor.com/ai/enterprise/