NSAuditor AI Enterprise 0.41.0: Amazon DocumentDB Gets Its Own Auditor

Amazon DocumentDB now has a dedicated auditor. NSAuditor AI Enterprise 0.41.0, published 26 August 2026, adds plugin 1230 AWS DocumentDB Auditor — the platform’s 29th Enterprise plugin — so a MongoDB-compatible cluster is assessed on its own terms rather than on terms borrowed from a different engine.

Why a managed database deserves its own auditor

DocumentDB answers the same AWS APIs as RDS. That is convenient for the people who build on it and awkward for the people who audit it, because the two engines do not share a configuration vocabulary. Multi-AZ means something different. Encryption is expressed at the cluster, not the instance. The switch that turns on audit logging is a cluster parameter, and turning it on is only half the job.

A dedicated auditor is how you stop approximating. Plugin 1230 evaluates seven dimensions per cluster:

• Storage encryption at rest, with KMS key-custody classification. Encryption on is the easy half. The auditor also classifies where the key lives — because a key held in an account you may not control is an evidence gap, never a default pass.
• TLS enforcement, read from the tls cluster parameter rather than inferred.
• Audit logging, and its CloudWatch export. Both, deliberately: logs generated but never exported die with the instance, and an auditor asking for six months of database activity does not accept a log that no longer exists.
• Automated backup retention.
• Deletion protection.
• Replica and Availability-Zone topology, under the cluster lens DocumentDB actually uses.
• Manual snapshot restorability — whether a snapshot can be restored publicly, or by an account you did not intend.

Named gaps beat quiet ones

The part worth dwelling on is not the dimension list. It is what happens when the scan cannot read something.

Every dimension the scan cannot evaluate becomes a named evidence gap rather than silence. This matters because a report that says nothing about a surface looks exactly like a report that examined it and found nothing wrong. An assessor cannot tell those apart, and neither can you six months later. In the same spirit, DocumentDB Elastic clusters — a separate API — are declared deferred rather than quietly omitted, and an Amazon Neptune estate carries a standing disclosure that it is unaudited, printed where an auditor reads rather than where only an engineer would look.

Remediation instructions now speak DocumentDB’s own API, so what the report hands an engineer is a command that runs on the resource it names.

Eight frameworks, and matrices that deliberately did not move

Plugin 1230 routes to all eight supported compliance frameworks — SOC 2, HIPAA Security Rule §164.312, NIST CSF 2.0, PCI DSS v4.0.1, ISO/IEC 27001:2022, CIS Controls v8, GDPR Article 32 as Security of Processing infrastructure substrate only (not GDPR compliance), and NIST SP 800-171 Rev 2 as evidence substrate for CMMC Level 2 preparation — through 245 new mapping entries keyed to the plugin’s own findings.

All eight coverage matrices are unchanged, and that is the accurate description of this release rather than a hedge. New evidence arriving on controls that were already covered adds depth, not breadth. A vendor whose coverage numbers rise on every release is telling you something about its counting, not about its product.

Availability

Enterprise 0.41.0 publishes alongside Community Edition 0.2.48 and agent-skill 0.2.46 — the 101st consecutive trio — and requires Community Edition 0.2.45 or newer. The catalog is now 29 Enterprise auditors, 56 plugins overall. Everything runs agentless and read-only on the customer’s own infrastructure.

npm install -g nsauditor-ai@0.2.48 @nsasoft/nsauditor-ai-ee@0.41.0

Details: nsauditor.com/ai/enterprise/