NSAuditor AI Enterprise 2.1.1: When the Scan Cannot Reach Your GCP Project, the Compliance Report Says So, and Why

An assessor reading your evidence should be able to tell “measured and passed” from “not measured”. NSAuditor AI Enterprise 2.1.1, published by Nsasoft US LLC on 1 November 2026 with Community Edition 1.1.1 and the agent skill 1.1.2, brings two more GCP auditors into line: with no GCP project set, or no usable credential loaded, the GCP Cloud Storage and IAM auditors report themselves down with the cause, and the controls they map fail closed as not measured. Community 1.1.1 adds an AI assessment that states its own coverage, moves to the openai 7 client, and makes tier denials name the tools you can use now.

GCP auditors that report themselves down, with the cause

Enterprise’s GCP coverage draws on three auditors: the GCP security audit (plugin 1021), the GCP Cloud Storage auditor (1024) and the GCP IAM project auditor (1025). In 2.1.1, when no GCP project is set or no usable credential loads, 1024 and 1025 return up: false with the same cause 1021 gives, and call no API. Every control that maps one of their rules then fails closed as not measured, with a scanner-down evidence-gap row that quotes the cause.

Where the rows land, framework by framework

The row appears only in frameworks that map the auditor, so each report carries the gap its own controls depend on:

• SOC 2, HIPAA and NIST SP 800-171 Rev 2 map both the Cloud Storage auditor (1024) and the IAM auditor (1025);
• CIS Controls v8 and ISO/IEC 27001:2022 map the Cloud Storage auditor (1024);
• NIST CSF 2.0 maps the IAM project auditor (1025).

The route is structural: no framework file changed, so all eight coverage matrices are unchanged.

Trend lines that stay honest across the upgrade

For an estate scanned with 2.1.0 and then with 2.1.1 with no GCP project set or no usable credential, the earlier scan’s 1024 and 1025 violations are withheld from MTTR closure, and the drift file lists them as could not measure, never as cleared.

Community 1.1.1: an AI assessment that states its coverage

After every AI response, the CLI compares the input tokens the provider reports with its own estimate of the input. When the provider reports reading less than half of it, the assessment files open with one line saying the assessment covers part of the scan, and the JSON response and the run record carry both numbers. The AI stage was run end to end on openai 7 against OpenAI and a local Ollama model before the release.

• openai 7 and one zod. The OpenAI client moves from openai 4 to openai 7, so a project that depends on Community holds one zod at 4.6.6 or later, with no overrides.
• Tier denials that name what you can use. A tool refused for the caller’s licence names the tools the caller can use now, derived from the licence and the install. compliance_matrix without the Enterprise package names the licence it needs.
• Scriptable licence commands. nsauditor-ai license with an unknown subcommand, or none, exits 2.

The agent skill 1.1.2 and the air-gap carrier

The agent skill 1.1.2 teaches the release to Claude: it covers the GCP auditors, a partial AI read, tier denials and the license exit codes. Offline teams get the 2.1.1 air-gap carrier, which ships Enterprise 2.1.1 with Community 1.1.1; replace a 2.1.0 carrier with it.

Eight frameworks, one read-only scan

NSAuditor AI Enterprise maps one read-only infrastructure scan across AWS, Azure and GCP to SOC 2, HIPAA, NIST CSF 2.0, PCI DSS v4.0.1, ISO/IEC 27001:2022, CIS Controls v8, GDPR Article 32 (security-of-processing infrastructure evidence) and NIST SP 800-171 Rev 2 (evidence for CMMC Level 2 preparation). It ships 29 Enterprise and 27 Community plugins. Zero Data Exfiltration: your scan data never goes to Nsasoft.

Upgrading

Install Node.js 24.22.1 or newer first, then install Enterprise 2.1.1 and Community 1.1.1 together in one command. Enterprise 2.1.1 reaches licensed customers through the restricted npm package:

npm i -g nsauditor-ai@1.1.1 @nsasoft/nsauditor-ai-ee@2.1.1

Enterprise starts at $2,000 per year for up to five seats: nsauditor.com/ai/enterprise. Pro starts at $39 per month billed annually: nsauditor.com/ai/pro. Community Edition is free and MIT-licensed on npm.