<p>Nsasoft US LLC has shipped <strong>NSAuditor AI Enterprise Edition 0.32.9</strong>, paired with Community Edition 0.2.34 and agent-skill 0.2.32. All three are live on npm.</p>
<p>NSAuditor AI is an agentless, read-only security scanner that audits AWS, Azure and GCP accounts and maps its findings into seven compliance frameworks from a single scan. This release concentrates on the quality of the document that comes out the other end.</p>
<h2>Scope reporting: what was measured, and what wasn’t</h2>
<p>The headline change is how the report handles a cloud it could not reach. In a multi-cloud scan, one provider may be unavailable while the others complete normally — an optional SDK not installed, or credentials for a single account unusable.</p>
<p>From 0.32.9, every in-scope control belonging to an unreachable cloud carries an <strong>explicit fail-closed evidence gap</strong>. The compliance report distinguishes clearly between scope that was measured and scope that was not, so an assessor reading the pack can see the boundary rather than infer it.</p>
<p>For a product built for air-gapped and offline deployment — environments where an optional dependency is most likely to be missing — this is the behaviour the evidence-gap contract exists to provide.</p>
<h2>Reports written for the person reading them</h2>
<p>An NSAuditor evidence pack is handed to a SOC 2 practitioner, an HHS-OCR investigator or a PCI QSA. In 0.32.9 the rendered report carries only assessor-facing content: internal engineering identifiers have been removed from finding titles, the attestation cover page and the chain-of-custody record.</p>
<p>The result was measured across <strong>105 files in a rebuilt three-cloud evidence pack</strong>. The instrument used to check it fails closed when its own positive control returns empty — a clean result from a tool that saw nothing is absent evidence, not evidence of absence.</p>
<h2>Evidence integrity, stated once</h2>
<p>Four report surfaces now describe evidence integrity identically. As shipped, integrity rests on a <strong>SHA-256 hash chain of custody</strong>, with a sidecar per artifact that an auditor verifies independently using <code>shasum -a 256 -c</code>. Ed25519 signing and RFC 3161 trusted timestamps are implemented but not exposed by any shipped entry point, and stay on the published roadmap until they are.</p>
<h2>Framework coverage is unchanged</h2>
<p>0.32.9 is matrix-neutral: 28 enterprise cloud plugins (55 with Community Edition’s 27), and all seven coverage matrices identical to 0.32.8 — SOC 2 10/4/33, HIPAA §164.312 7/3/45, NIST CSF 2.0 13/10/83, PCI DSS v4.0.1 19/9/39, ISO/IEC 27001:2022 17/14/62, CIS Controls v8 17/23/113, and GDPR Article 32 4/5/2 as infrastructure substrate only, not GDPR compliance.</p>
<h2>Two upgrade notes</h2>
<p>The evidence-gap finding title has changed, so suppression rules matching the old text will stop matching — findings resurface rather than hide, but the change is silent and existing rules should be reviewed against the CHANGELOG, which lists both strings. Separately, scans archived before 0.32.9 should be re-scanned rather than re-processed; the engine now warns when it detects archived input.</p>
<p>Community Edition 0.2.34 additionally fixes <code>–out</code> writing to the parent directory when the target name contains a dot.</p>
<p>A synthetic sample evidence pack spanning all seven frameworks is available at <a href=”https://www.nsauditor.com/ai/docs/sample-scan/”>nsauditor.com/ai/docs/sample-scan/</a>.</p>
