If you are the person who hands a PCI DSS evidence pack to a QSA, NSAuditor AI Enterprise 0.46.0 changes one thing you will care about: every citation in it is now derived from the standard itself. Sub-requirement identifiers, Customized Approach eligibility and objective wording are read from the PCI SSC publication rather than transcribed from a summary of it, and the derivation ships guarded so a citation cannot drift. Nsasoft US LLC published the release on 9 September 2026 alongside Community Edition 0.2.53 and the agent skill 0.2.51 — the 106th consecutive trio.
Why a citation is evidence
Every compliance product cites standards. A PCI DSS assessor does not read the tool’s summary of Requirement 8; they read the requirement, and they check that the identifier beside a finding names a real sub-requirement, that the eligibility answer beside it matches the standard’s own text, and that the objective quoted is the one the standard states. A citation a QSA can check against the standard is evidence. One they cannot is doubt — and doubt spreads to everything beside it. Release 0.46.0 is built around that reading.
Derived from the publication, not transcribed from a summary
NSAuditor AI now reads its PCI DSS v4.0.1 citations from the PCI SSC publication. A derivation script reads the standard into a compact, self-validating artifact — 344 sub-requirement identifiers, the ineligibility markers the standard carries, and the appendix titles read from the document’s own table of contents — and refuses to write when it cannot reproduce its own known answers. The compliance mapping file points at that artifact rather than holding a second copy, so there is one source of truth and nothing that can quietly diverge from it. Only identifiers and section names ship: the standard’s text is licensed and is not redistributed.
Customized Approach eligibility, read from where the standard states it
PCI DSS v4.0.1 states whether a requirement is eligible for the Customized Approach inside each requirement’s own Customized Approach Objective cell — not in an appendix. NSAuditor’s eligibility answers are now read from exactly there, and every one of the 28 controls the engine maps is Customized-eligible. For an operator that matters in a concrete way: no implementation option the standard grants you is ever closed by the tool’s data. The identifiers the standard marks ineligible are enumerated in the out-of-scope groups, visible to a reader rather than silently absent.
An objective column that says whose words it is
Every Customized Approach Objective in the mapping now carries a per-control provenance flag: the requirement cell’s own wording, or NSAuditor’s paraphrase of it. The compliance report labels each objective from that flag rather than asserting one label for all of them, so an assessor sees exactly what kind of citation they are reading. Sampling guidance follows the same discipline — assessor-facing procedures cite Section 6 of the standard, which leaves sample size to the assessor’s documented determination, and any suggested starting figure is labelled as NSAuditor’s own.
Guarded so it stays true
The correction ships with the instruments that keep it correct. An identifier-existence guard fails the build on any cited PCI DSS identifier absent from the derived set. Every objective flagged verbatim is checked against the document in both directions — a verbatim entry that differs from its cell is a misquotation, and a paraphrase identical to its cell understates. Two new count families report a stale published number against the code that owns it. The effect for a customer is simple: a drifting citation is a red test on Nsasoft’s side, never a line in your report.
What the numbers are
The PCI DSS v4.0.1 coverage matrix is enumerated at 19 covered, 9 partial and 44 out of scope across 72 sub-requirements. Covered and partial are unchanged and no control changed status; the out-of-scope enumeration grew so that identifiers the standard marks ineligible are visible rather than absent. The other seven framework matrices — SOC 2, HIPAA, NIST CSF 2.0, ISO/IEC 27001:2022, CIS Controls v8, GDPR Article 32 (Security of Processing infrastructure substrate only, not GDPR compliance) and NIST SP 800-171 Rev 2 (evidence substrate for CMMC Level 2 preparation) — are unchanged. The plugin catalogue stays at 56 — 29 Enterprise auditors (28 cloud auditors plus one Zero Trust posture check) and 27 Community plugins — and Enterprise 0.46.0 requires Community Edition 0.2.49 or newer, unchanged.
Availability
@nsasoft/nsauditor-ai-ee@0.46.0 (Enterprise, restricted access, licence required), nsauditor-ai@0.2.53 (Community, MIT) and nsauditor-ai-agent-skill@0.2.51 are on npm; Community Edition installs first. Every edition runs entirely on the customer’s own infrastructure with read-only credentials enforced in code, and eight compliance evidence packs come from one agentless scan. Details: nsauditor.com/ai/enterprise/ · PCI DSS coverage: nsauditor.com/ai/docs/pci/.
