If you run Amazon DocumentDB, NSAuditor AI Enterprise 0.41.0 is the release that starts reading your clusters properly. Plugin 1230 AWS DocumentDB Auditor ships as the platform’s 29th Enterprise plugin, published 26 August 2026.

What the plugin actually reads

Seven dimensions, evaluated per cluster, in DocumentDB’s own vocabulary:

1. Storage encryption at rest — plus a key-custody classification of the KMS key. Where the key lives is part of the finding, not a footnote: a key in an account you may not control is recorded as an evidence gap rather than a pass.
2. TLS enforcement, from the tls cluster parameter.
3. Audit logging — the audit_logs parameter and the CloudWatch export, because logs that are generated but never exported do not outlive the instance.
4. Automated backup retention.
5. Deletion protection.
6. Replica and Availability-Zone topology, under the cluster lens DocumentDB uses.
7. Manual cluster snapshots — restorable publicly, or by accounts you did not intend?

What an evidence gap looks like

When the scan cannot read a dimension — a permission it does not have, an API that did not answer — it does not drop the dimension. It writes a named evidence gap into the report, saying which dimension went unevaluated and why.

That is a small design decision with a large consequence at audit time. Silence and a clean result are the same shape on the page. A gap that names itself is something you can act on: grant the permission, re-run, and watch it close.

The same rule governs scope. DocumentDB Elastic clusters use a separate API and are declared deferred rather than silently skipped. An Amazon Neptune estate carries a standing disclosure that it is unaudited. Both statements appear where an auditor reads them.

Running it

npm install -g nsauditor-ai@0.2.48 @nsasoft/nsauditor-ai-ee@0.41.0

nsauditor-ai scan --host aws --plugins all \
  --compliance soc2,hipaa,nist-csf,pci-dss,iso-27001,cis-v8,gdpr,nist-800-171

One read-only pass produces eight framework-mapped evidence packs. Plugin 1230 contributes 245 new mapping entries across those frameworks, and all eight coverage matrices are unchanged — the new findings land on controls already covered, which is what evidence depth looks like when it is reported honestly.

Enterprise 0.41.0 pairs with Community Edition 0.2.48 and agent-skill 0.2.46, and requires Community Edition 0.2.45 or newer. Catalog: 29 Enterprise auditors, 56 plugins overall, agentless and read-only on your own infrastructure.

nsauditor.com/ai/enterprise/