NSAuditor AI Enterprise 0.42.0: Partition-Correct Auditing for GovCloud, China and Europe’s Sovereign Cloud
EE 0.42.0 makes AWS auditing partition-correct across GovCloud, China, ISO and the European Sovereign Cloud, and puts an estate stamp on every Azure scan.
Nsasoft US LLC has released NSAuditor AI Enterprise 0.42.0, a release aimed squarely at organisations that run a commercial cloud estate and a sovereign or government one side by side. The headline is straightforward: your GovCloud, China, intelligence-community and European Sovereign estates are now audited as themselves, and every Azure scan states which estate it addressed.
Why a partition is not just another region
Amazon Resource Names begin with a partition token. In the commercial cloud that token is aws. In GovCloud it is aws-us-gov; in the China regions it is aws-cn; the intelligence-community and European Sovereign partitions carry four more. A tool that assumes the commercial token is not simply less precise in a government estate — it is reading a different namespace.
0.42.0 closes a four-part internal work lane that made resource-name handling, severity ladders and region dispatch partition-aware end to end. The practical consequence for a security team is that a finding raised in GovCloud now lands with the same weight it would carry in commercial: IAM privilege-escalation findings keep their severity and their shadow-administrator graph edges, the KMS effective-decrypt ladder keeps its gradations, and access-point exposure on a delegated bucket is assessed the same way wherever it lives.
The Azure half, and the question that actually matters
Azure’s sovereign clouds are selected explicitly in this release, through any of four environment variables: AZURE_ENVIRONMENT, ARM_ENVIRONMENT, AZURE_ARM_ENDPOINT or AZURE_AUTHORITY_HOST. Credential construction and every Azure Resource Manager client now carry an authority host, a management endpoint and a credential scope derived from that selection.
The design decision worth noticing is that resolution fails closed. A selection the product does not recognise, or two variables that name different estates, produces a refusal and an evidence gap that names the variable which would fix it. It does not quietly fall back to the commercial cloud.
Paired with that, every Azure scan now stamps the estate it addressed into its own summary. For anyone who has ever had to answer an auditor asking which subscription was this report about?, that single line is the feature. A report is only as useful as the certainty about its subject, and this release makes the subject inspectable rather than assumed.
Supply chain and cryptographic posture
Two additions round out the release, both aimed at the reviewer rather than the operator.
The first is an on-demand software bill of materials in CycloneDX or SPDX format. Its subject is deliberately the package a customer installs, not the maintainer’s working tree: the generator builds the tarball, installs it with its declared Community Edition peer into an empty directory, and generates the document there, stamped with the tarball it describes. If the underlying tooling cannot see the full dependency graph, the generator writes nothing rather than emitting a partial document.
The second is a published FIPS posture statement. It states that the product employs FIPS-approved algorithms and that it is not, and does not contain, a FIPS 140-validated cryptographic module — and it is explicit that whether the runtime beneath it is one remains a property of the operator’s own Node and OpenSSL build. It is a document written to be checked rather than filed.
Catalog and coverage
The plugin catalog is unchanged at 29 Enterprise auditors — 28 cloud auditors plus a network-host Zero Trust posture assessment — for 56 plugins overall with a licence active. All eight coverage matrices are unchanged as well, and the reason is worth stating plainly: this release deepens correctness on controls that were already covered rather than adding new ones. A release that moved the numbers here would be describing different work.
The eight supported frameworks remain SOC 2 (AICPA TSC 2017), HIPAA Security Rule §164.312, NIST Cybersecurity Framework 2.0, PCI DSS v4.0.1, ISO/IEC 27001:2022, CIS Critical Security Controls v8, GDPR Article 32 (Security of Processing infrastructure substrate only, not GDPR compliance) and NIST SP 800-171 Rev 2 (evidence substrate for CMMC Level 2 preparation, not a certification).
What it does not claim
Nsasoft is explicit that this is evidence substrate for an assessment rather than an assessment. Support for a partition means the product addresses the estate you name; it is not a FedRAMP authorization, not a CMMC certification, and not an assertion about your assessment boundary. That determination remains with your authorizing official.
Availability
Enterprise 0.42.0 is on npm now, alongside Community Edition 0.2.49 and the agent-skill package 0.2.47. The peer floor rises to Community Edition 0.2.49 or newer, and the install order matters — install Community Edition first, so the Enterprise package resolves against the version that carries the matching partition detection.
npm install -g nsauditor-ai@0.2.49 @nsasoft/nsauditor-ai-ee@0.42.0Everything runs on customer infrastructure, read-only, with customer-supplied AI API keys. Full details on the NSAuditor AI Enterprise page.
