NSAuditor AI Enterprise 0.32.9: Stricter Evidence Gaps and Cleaner Compliance Packs

<p>Nsasoft US LLC has released <strong>NSAuditor AI Enterprise Edition 0.32.9</strong>, a report-quality release focused on how compliance evidence is presented to auditors. It ships alongside Community Edition 0.2.34 and agent-skill 0.2.32, all live on npm.</p>

<p>The organising principle for the release is a simple one: <strong>coverage you didn’t measure is never presented as coverage you did.</strong></p>

<h2>Stricter evidence gaps</h2>

<p>NSAuditor AI Enterprise audits AWS, Azure and GCP from a single read-only scan. In multi-cloud environments, a given cloud is not always reachable — an optional SDK may not be installed, or credentials for one account may be unavailable while the others are fine.</p>

<p>In 0.32.9, every in-scope control belonging to a cloud that could not be scanned now carries an <strong>explicit, fail-closed evidence gap</strong> in the compliance report. The report states plainly which parts of the scope were measured and which were not, rather than leaving unmeasured controls to be read as satisfied.</p>

<p>This matters most in exactly the deployments NSAuditor is built for. The product is positioned on air-gapped and offline operation, and those are the environments where an optional dependency is most likely to be absent.</p>

<h2>Cleaner evidence packs</h2>

<p>An NSAuditor evidence pack is not a dashboard. It is a set of files a customer hands to a SOC 2 practitioner, an HHS-OCR investigator or a PCI QSA — so everything inside it should be meaningful to that reader.</p>

<p>0.32.9 strips internal engineering identifiers from every rendered report. Finding titles, the attestation cover page and the chain-of-custody record now carry only assessor-facing content. The result was verified across <strong>105 files in a rebuilt three-cloud evidence pack</strong>, using an instrument that carries its own positive control — it fails closed if its control set comes back empty, on the principle that a clean result from an instrument that saw nothing is absent evidence rather than evidence of absence.</p>

<h2>One consistent story on evidence integrity</h2>

<p>Four report surfaces that previously described trusted timestamping in different terms now say the same verifiable thing. As shipped, evidence integrity is provided by a <strong>SHA-256 hash chain of custody</strong>: each artifact ships with a sidecar an auditor can verify independently with <code>shasum -a 256 -c</code>. Ed25519 signing and RFC 3161 trusted timestamps are implemented but not exposed by any shipped entry point, and remain on the published roadmap.</p>

<h2>Unchanged, deliberately</h2>

<p>The release is matrix-neutral. The plugin count remains at <strong>28 enterprise cloud plugins</strong> (55 including Community Edition’s 27), and all seven coverage matrices are identical to 0.32.8 in both counts and control-id membership:</p>

<ul>
<li>SOC 2 (AICPA TSC) — 10 covered / 4 partial / 33 out of scope</li>
<li>HIPAA Security Rule §164.312 — 7 / 3 / 45</li>
<li>NIST CSF 2.0 — 13 / 10 / 83</li>
<li>PCI DSS v4.0.1 — 19 / 9 / 39</li>
<li>ISO/IEC 27001:2022 — 17 / 14 / 62</li>
<li>CIS Controls v8 — 17 / 23 / 113</li>
<li>GDPR Article 32 — 4 / 5 / 2 (infrastructure substrate only, not GDPR compliance)</li>
</ul>

<h2>Upgrade notes</h2>

<p>Two changes need attention when upgrading:</p>

<ol>
<li><strong>The evidence-gap finding title changed.</strong> Suppression rules that matched the previous text will stop matching. The direction is safe — affected findings resurface rather than hide — but the change is silent, so existing suppression rules should be reviewed. The CHANGELOG carries both strings verbatim along with the one-line fix.</li>
<li><strong>Re-scan rather than re-process archived scans</strong> captured before 0.32.9. The engine now detects archived input and warns instead of completing silently.</li>
</ol>

<p>Community Edition 0.2.34 also fixes <code>–out <dir></code> writing to the parent directory when the directory name contains a dot, and corrects plugin-provenance reporting in <code>validate</code>.</p>

<h2>Availability</h2>

<p>EE 0.32.9, CE 0.2.34 and agent-skill 0.2.32 are available on npm now. A sample evidence pack covering all seven frameworks is published at <a href=”https://www.nsauditor.com/ai/docs/sample-scan/”>nsauditor.com/ai/docs/sample-scan/</a>, and full product detail is at <a href=”https://www.nsauditor.com/ai/enterprise/”>nsauditor.com/ai/enterprise/</a>.</p>