NSAuditor AI is open core, runs offline, and ships with a typed plugin SDK. These docs cover the install, the architecture, the plugin model, the compliance evidence, and the air-gapped operation guide that procurement asks about.
CURRENT · EE 1.0.0 · 2026-09-15 EE 1.0.0 · CE 0.2.54 · agent-skill 0.2.52
EE 1.0.0 (2026-09-15) — 1.0: the contract freeze becomes binding, and the cargo is corrective. Coverage: all eight coverage matrices unchanged since EE 0.46.0. 56 plugins in total (27 Community + 29 Enterprise). EE 1.0.0 requires CE ≥ 0.2.49; paired CE 0.2.54 + agent-skill 0.2.52. Release history lives in the package CHANGELOG.md.
NIST SP 800-171 Rev 2 is the eighth compliance framework, and it routes from the same single read-only scan as the other seven. Every mapped requirement carries the full list of its SP 800-171A determination statements alongside the 69 of 172 this engine supplies examine-method material for, so a C3PAO reads exactly which objectives your configuration already evidences — coverage claimed at the level an assessment is actually scored at. All 110 Rev 2 requirements are enumerated with no declared subset, Rev 2 is pinned deliberately because CMMC assesses Rev 2 by rule, and it is scoped as evidence substrate for CMMC Level 2 preparation: it feeds your System Security Plan and POA&M and leaves the determination with your assessor. Read the coverage page →
Upgrading — three things to know. (1) Coming from a build older than 0.32.9: the evidence-gap finding title changed, so suppression rules written against the old text stop matching. The direction is safe — findings resurface rather than hide — but it is silent, so re-check your suppression list against the new titles. (2) Re-scan rather than re-processing scans captured before 0.32.9; the engine warns when it is handed an older archive. (3) Your next SOC 2 report carries four additional out-of-scope rows — CC7.4, CC7.5, A1.1 and A1.3, each with its reason. Nothing you were passing has moved.
From zero to first scan in under two minutes — no signup, no credit card, no telemetry. Works on macOS, Linux, and Windows.
New customer? The linear path from your purchase email (license key + npm token) to your first audit-evidence report: install Node.js + the trio, activate your license, configure AWS/Azure/GCP credentials, run your first cloud audit, scope it with --aws-region (one region, a CSV list, or every enabled region), and drive it conversationally from Claude Desktop via MCP.
Install in 30 seconds. Run your first scan, decode the output, point it at AWS / TLS / DNS / OT targets, export reports.
github · README →How the engine, plugins, AI providers, and report writers fit together. Where data flows. What stays local. Which outbound paths exist, and why each is opt-in.
github · README →All 56 plugins (27 network/host + 29 Enterprise — 28 cloud auditors plus 1023 Zero Trust Assessment, which scores a network-host scan rather than calling a cloud API) listed with what they probe, what they verify, and false-positive notes. AWS auditors include 1070 KMS, 1080 Lambda Security, 1090 Secrets Manager + SSM, 1100 CodePipeline + CodeBuild, 1110 IAM Effective Decrypt-Path, 1120 S3 Lifecycle + Replication, 1130 AWS Backup (12-dimension air-gapped vault attestation — the A1.2 ransomware-defense substrate), 1140 RDS + Aurora, 1150 SQS + SNS, 1160 VPC Endpoints, 1170 EC2 Security-Group Perimeter, 1180 ElastiCache/Redis, 1190 SES, 1200 Inspector + GuardDuty, and 1210 EC2 Instance Metadata.
github · plugins/ →How the offline NVD feed works, how version-string matching turns service banners into CVE findings, and how risk scoring plus the operator suppression workflow (accepted-risk / false-positive) prioritize them. Findings are emitted unverified — no automated probes.
github · README →Run NSAuditor AI as an MCP server. Wire it into Claude Code, Cursor, or any MCP-aware client. 5 CE tools, 9 Pro tools, and a Skill package for agents.
github · README →AICPA TSC 2017 mapping — 10 covered + 4 partial + 37 explicitly out-of-scope across the complete 51-criterion universe, with multi-cloud evidence (AWS S3 + IAM, Azure RBAC + NSG + Storage, GCP IAM + Cloud Storage, on-prem network). C1.2 Disposal with S3 Object Lock COMPLIANCE-mode. Cover-page Scope Attestation, SHA-256 chain-of-custody, a documented suppression workflow, GRC-ready evidence JSON (Vanta connector library). Type I & Type II.
read the SOC 2 guide →HIPAA §164.312 Technical Safeguards mapping — 7 covered + 3 partial + 45 explicit OOS (entire §164.308 Administrative + §164.310 Physical with named architectural-limit reasons). Per-control Required/Addressable discipline + HHS rule-text verbatim. §164.312(c)(1) ransomware-defense substrate via aws-backup-auditor Logically Air-Gapped Backup Vault cross-verification (HHS-OCR 2024 enforcement-relevant). Dual-framework one-scan workflow: --compliance soc2,hipaa. Zero BAA required — ePHI never leaves customer infrastructure.
NIST Cybersecurity Framework 2.0 (NIST CSWP 29, February 2024) mapping at the auditor-canonical Subcategory level — 13 covered + 10 partial + 83 OOS across 106 of CSF 2.0's 107 Subcategories. Govern function OOS-by-design (GV.SC-04 partial as substrate exception). Respond function OOS-entirely (IR runbook execution). Implementation Tiers 1-4 OOS as organizational-maturity claims — cover-page disclaimer (markdown + HTML parity). Triple-framework one-scan workflow: --compliance soc2,hipaa,nist-csf produces three complete evidence packs. Air-gapped operation, providing the technical evidence layer that feeds a DFARS / CMMC federal-contractor programme. NSAuditor's air-gapped operation is compatible with the FedRAMP / DFARS / CMMC threat model where SaaS data flow is prohibited.
PCI DSS v4.0.1 (PCI SSC, June 2024 errata; v3.2.1 retired March 31, 2024) mapping at the auditor-canonical sub-requirement level — 19 covered + 9 partial + 44 OOS across 72 enumerated sub-requirements — a declared subset of the 227 main-body leaf sub-requirements, every identifier derived from the PCI SSC publication. Req 12 Information Security Program OOS-by-design entirely (governance, policy, Targeted Risk Analysis Req 12.3.1, Customized Approach Documentation Req 12.3.2, TPSP Responsibility Matrix Req 12.8.5, IR program). Req 5 anti-malware + Req 9 physical OOS-entirely (endpoint EDR + facility-tier). Customized Approach eligibility read from each requirement’s own Customized Approach Objective cell — the ineligible set is derived from the standard, every mapped control is Customized-eligible, and a build guard refuses any identifier the standard does not contain. CHD Scope operator-attested via CDE Data Flow Diagram per Req 1.2.4 + Req 12.5.1. Customized Approach Objective on every mapped control, flagged per control as the standard’s own cell wording or NSAuditor’s paraphrase and verified against the document in both directions. Card-brand AOC enforcement view (Visa CISP / Mastercard SDP / Amex DSOP / Discover DISC).
read the PCI DSS guide →ISO/IEC 27001:2022 (ISO + IEC, October 2022; 2013 edition retired October 31, 2025) mapping at the auditor-canonical per-Annex-A-code level — 17 covered + 14 partial + 62 OOS across 93 Annex A controls (the complete Annex A universe across 4 themes: A.5 Organizational 37 + A.6 People 8 + A.7 Physical 14 + A.8 Technological 34). Statement of Applicability per Clause 6.1.3.d discipline — every control carries soaApplicability field; engine produces substrate for INCLUDED controls; SoA inclusion/exclusion is operator-side. ISMS Management-System Clauses 4-10 OOS-by-design with 7 Major Nonconformity classes — absence of internal audit per Clause 9.2 or management review per Clause 9.3 = auto-fail Stage 2 (the most-frequent first-time certification failure mode). 11 NEW 2022 controls explicitly enumerated (3 COVERED + 2 PARTIAL + 6 OOS): A.5.7 Threat intelligence · A.5.23 Cloud services · A.5.30 ICT readiness for BC · A.7.4 Physical security monitoring · A.8.9 Configuration management · A.8.10 Information deletion · A.8.11 Data masking · A.8.12 DLP · A.8.16 Monitoring activities · A.8.23 Web filtering · A.8.28 Secure coding. 5-attribute taxonomy NEW in 2022 (controlType / informationSecurityProperties / cybersecurityConcepts — 5 categories, NOT 6 like NIST CSF 2.0 / operationalCapabilities / securityDomains). 2013-to-2022 transition discipline enforced at schema layer (35 unchanged + 23 renamed + 57 merged-into-24 + 11 NEW = 93). Penta-framework one-scan workflow: --compliance soc2,hipaa,nist-csf,pci-dss,iso-27001 produces five complete evidence packs. Pair with ISO-aware GRC (Drata ISO 27001 / Vanta ISO 27001 / AuditBoard / OneTrust ISMS / Secureframe ISO 27001) for SoA + internal audit + management review workflow.
CIS Controls v8 (Center for Internet Security, May 2021; v8.1 errata June 2024) mapping at the per-Safeguard level — 17 covered + 23 partial + 113 OOS across 153 Safeguards / 18 Controls (engine substrate IG1 23-of-56 / IG2-cumulative 38-of-130 / IG3-cumulative 40-of-153). CIS-Hardened-Image detection is LIVE across AWS + Azure + GCP (plugin 1210 aws-ec2-instance-auditor + Azure/GCP image-inventory producers; the renderer flips the credit from eligible → observed when a Hardened-Image is detected) + Safeguard 9.5 Implement DMARC partial. A dedicated Azure Storage Account data-protection auditor (plugin 1220) covers blob recoverability (→ CIS 11.1) + per-container public-access (→ CIS 3.3) dims, and a dedicated Azure NSG perimeter auditor (plugin 1221 — the Azure analog of AWS 1170, routing to CIS 4.4/12.2/4.2) rounds out the perimeter coverage. Implementation Group cumulative discipline — IG1=56 (the cyber-insurance baseline; ~50-70% of mid-market policies require IG1 attestation), IG2 cumulative=130, IG3 cumulative=153; smallest-IG-membership tagging (NEVER report IG2 as 74-of-74 in isolation; the IG1 base must be intact before any IG2/IG3 claim). No-certification-body attestation discipline — CIS has no formal certification body; engine output is INPUT to CSAT / CIS-CAT Pro self-attestation OR a SOC 2 auditor cross-validating CIS scope OR CIS-SecureSuite peer review, NEVER "CIS certified." Cloud Companion Guide v8 shared-responsibility-model boundary per Safeguard + CIS-Hardened-Image substrate-evidence credit (Safeguards 4.1/4.2/4.6). 5 Security Functions (NOT 6 — no Govern) + 6 Asset Types + MS-ISAC/EI-ISAC/H-ISAC sector baselines + v7.1-to-v8 cross-reference. Octa-framework one-scan workflow: --compliance soc2,hipaa,nist-csf,pci-dss,iso-27001,cis-v8,gdpr,nist-800-171 produces eight complete evidence packs (the seventh being the GDPR Article 32 security-of-processing infrastructure substrate, the eighth the NIST SP 800-171 Rev 2 evidence substrate for CMMC Level 2 preparation). Pair with CIS-aware GRC (Drata CIS / Vanta CIS / AuditBoard CIS) or CIS-CAT Pro for the self-attestation workflow.
GDPR Article 32 infrastructure substrate — security of processing. 4 covered + 5 partial + 2 OOS across 11 sub-measure units. Art. 32 substrate only, NOT GDPR compliance; Art. 83(4) lower fine tier.
read the GDPR Article 32 guide →All 110 Rev 2 requirements enumerated — 2 covered + 49 partial + 59 out of scope with a written reason, claimed at the SP 800-171A determination-statement level. Not a certification, no MET/NOT MET verdict, no SPRS score.
read the SP 800-171 guide →Push your compliance-scan evidence to your GRC platform at scan time. Set COMPLIANCE_GRC_PROVIDER + COMPLIANCE_GRC_TOKEN and each scan maps its findings to Vanta test results, Drata Custom Connections records, or Secureframe evidence-collection records and pushes them — opt-in, Zero-Data-Exfiltration by default, token never serialized. Suppression-aware outcomes, deterministic idempotency, rate-limit backoff, circuit breaker, and a per-control audit artifact. Vanta activated; Drata shipped; Secureframe shipped (early-access). Early-access, single-workspace; live-tenant validation in progress.
The 6-page brochure customers and resellers ask for: what NSAuditor AI Enterprise does, how one scan produces eight framework-mapped evidence packs (SOC 2 · HIPAA · NIST CSF 2.0 · PCI DSS v4.0.1 · ISO/IEC 27001:2022 · CIS v8 · GDPR Article 32 substrate · NIST SP 800-171 Rev 2 evidence substrate for CMMC Level 2 preparation), the full Enterprise capability set (cloud scanners, GRC platform connectors, air-gapped operation, Zero Data Exfiltration, continuous monitoring), current coverage counts, edition comparison with tier pricing, and the Reseller Partner Program. Letter format, ~110 KB — built to forward to procurement, security review, and partners.
download the brochure (PDF) →A practical, vendor-neutral walkthrough of the complete audit lifecycle from the team that has built network security auditors since 2004: what a network security audit is, the role of a network auditor, the 10-step audit checklist (scope & inventory → discovery → configuration review → vulnerability validation → IAM → DNS/email → cloud accounts → logging/backups → compliance mapping → remediation & re-audit), manual vs. automated auditing, audit frequency, and best practices — including read-only audit credentials and keeping evidence on your own infrastructure. Embeds the 6-minute "Network Security Audits" explainer video.
read the audit guide →Walk-through of an octa-framework scan recorded on EE 0.40.1 against a fictional Acme Corp AWS account 111122223333. One scan, 11 AWS EE plugins, 76 findings routed across SOC 2 AICPA TSC 2017 + HIPAA Security Rule §164.312 + NIST CSF 2.0 + PCI DSS v4.0.1 + ISO/IEC 27001:2022 + CIS Controls v8 + GDPR Article 32 + NIST SP 800-171 Rev 2. 69 evidence artifacts per scan with SHA-256 chain-of-custody. Includes PCI DSS deep-dive showing 4 load-bearing schema enrichments + the six main-body sub-requirements the standard marks ineligible for the Customized Approach + CDE-scope operator-attestation disclaimer. All data synthetic — no real infrastructure disclosed.
view the sample scan →A linux/amd64 container image or an npm host install, with signed JWT licensing validated locally — no phone-home and no heartbeat, tcpdump-verifiable. The scan path makes no outbound calls once NSAUDITOR_OFFLINE_ONLY=1 is set; AI enrichment and the GRC push are the only other outbound paths, and both are opt-in and off by default.
Write your own plugin in TypeScript. Typed signature, scaffolder, local test harness. Same SDK we use to ship the 56 built-in plugins.
github · sdk/ →Version history, breaking changes, security advisories. Subscribe to the RSS feed of releases or watch the repo on GitHub.
github · releases →Install via npm, run your first scan, browse the plugin source, write a custom plugin. Source-of-truth lives on GitHub.
→ github.com/nsasoft/nsauditor-aiRisk-scored prioritization and an operator suppression workflow (accepted-risk / false-positive) cut false-positive triage. CVE matching uses an offline NVD feed. Reports export as JSON, SARIF, CSV, Markdown, or HTML. Pro and Enterprise add report --from <run> --format executive — a self-contained, print-ready HTML report you can send, with no external network reference in the file — and --format jira for a Jira-importer CSV (the import mapping is configured in Jira; it is not validated against a live instance). If finding-like records sit somewhere the report does not read, the report names and counts them on the page.
MSA, DPA, net-30 invoicing. Air-gapped operation for OT, payment-processing CDE-isolation, ISO 27001 ISMS-scope-controlled, and regulated environments, plus the technical evidence layer that feeds a federal-contractor DFARS / CMMC programme. Octa-framework auditor-grade evidence — SOC 2 + HIPAA §164.312 + NIST CSF 2.0 Core + PCI DSS v4.0.1 + ISO/IEC 27001:2022 + CIS Controls v8 + GDPR Article 32 security-of-processing substrate + NIST SP 800-171 Rev 2 evidence substrate for CMMC Level 2 preparation — with SHA-256 chain-of-custody and GRC-ready evidence JSON (Vanta connector library). Zero BAA required (ZDE).
→ SOC 2 guide · HIPAA guide · NIST CSF 2.0 guide · PCI DSS guide · ISO 27001 guide · CIS v8 guide · GDPR Art. 32 guide · SP 800-171 guide →Try it free with the MIT-licensed Community Edition. Upgrade to Pro for CVE matching and risk-scored prioritization, or to Enterprise for cloud plugins and compliance frameworks.