Evidence That Proves Itself: NSAuditor AI Enterprise 0.40.3 Binds Every Trusted Timestamp to Its Artifact

Compliance evidence is only worth what an assessor can independently confirm. NSAuditor AI Enterprise Edition 0.40.3, released this week by Nsasoft, is built entirely around that principle: every trusted timestamp in an evidence pack is now cryptographically bound to the exact artifact it attests, checked before the pack is written, and verifiable by the auditor with stock openssl and no vendor software anywhere in the path.

Evidence that proves itself

NSAuditor AI Enterprise runs one agentless, read-only scan across AWS, GCP, Azure and on-premises networks and produces eight framework-mapped evidence packs in parallel — SOC 2, HIPAA Security Rule §164.312, NIST CSF 2.0, PCI DSS v4.0.1, ISO/IEC 27001:2022, CIS Controls v8, GDPR Article 32 as Security of Processing infrastructure substrate, and NIST SP 800-171 Rev 2 as evidence substrate for CMMC Level 2 preparation.

Each pack carries SHA-256 chain-of-custody attestations. Operators who want a trusted third party in the chain can enable RFC 3161 timestamping by naming their own Time-Stamp Authority in NSAUDITOR_TSA_URL — there is no default authority and no other outbound path, so the operator decides who signs and nobody else is contacted.

What 0.40.3 adds

Version 0.40.3 makes that timestamp chain self-checking. A granted RFC 3161 token carries a messageImprint — the digest the authority is attesting. The engine now compares that field against the digest of the artifact the request was built from, and admits the token into the evidence pack only when the two agree.

The result is a guarantee an operator can state plainly to an assessor: the .tsr sidecar in this pack provably belongs to the artifact beside it. Where the comparison cannot be satisfied, nothing is written and the reason is recorded by name — one of eight precise outcome codes captured per artifact in the chain-of-custody envelope, covering everything from an authority declining the request to a response the standard does not admit. A named outcome is what turns a missing sidecar into an actionable engineering fact instead of a silence.

The envelope now also records artifacts[].tsa.imprintVerified as an explicit boolean, so an auditor reading the JSON gets a direct answer rather than an inference, and a run configured for timestamping reports its signing tally once, with codes attached.

Broader authority compatibility

0.40.3 also widens the range of Time-Stamp Authorities the product works with. CMS permits BER-encoded tokens and openssl ts -verify accepts them, so tokens in that encoding are now honoured whenever a reader can decode them. Enterprises standardising on commercial authorities — DigiCert, GlobalSign, Sectigo and peers, reachable together with the policy-OID support added in 0.40.2 — get a cleaner path to their existing trust infrastructure.

One line, run by the auditor

The verification instruction printed on every report cover page is one the assessor executes themselves, exactly as printed:

openssl ts -verify -in <file>.tsr -data <file> -CAfile <ca-bundle>

Stock openssl. The authority the customer chose. None of the vendor’s software in the path. That independence is the point of the design: evidence that only verifies through the tool that produced it is evidence an assessor has to take on faith, and NSAuditor AI Enterprise is built so they never have to.

Nsasoft notes one upgrade step worth ten seconds of an operator’s time: packs timestamped on earlier versions predate the imprint binding, so re-running the command above brings them up to the current standard.

A release cadence customers can plan around

The scanner catalog holds at 28 Enterprise auditors and 55 plugins overall, and all eight compliance coverage matrices are unchanged — this release strengthens the evidence layer beneath them rather than moving the ground under an operator’s existing reports.

It also marks a milestone that says something about how the product is run: Enterprise Edition 0.40.3, Community Edition 0.2.47 and the agent skill 0.2.45 ship together as the hundredth consecutive paired trio. One hundred releases in a row where the enterprise engine, the open Community Edition and the agent integration moved as one version-locked set, with no drift for a customer to discover in production.

NSAuditor AI Enterprise starts at $2k/yr. Coverage matrices for all eight frameworks, and the full plugin catalog, are published at nsauditor.com/ai/pricing.