Audit-ready compliance evidence from one read-only scan — SOC 2, HIPAA, NIST CSF 2.0, PCI DSS v4.0.1, ISO/IEC 27001:2022, CIS Controls v8, GDPR Article 32, and NIST SP 800-171 Rev 2, mapped from a single pass across AWS, Azure and GCP. 56 plugins, built on an open-source core. Runs entirely on your infrastructure — zero data exfiltration by architecture.
The cloud-audit + compliance engine shown above is NSAuditor AI Enterprise · Community Edition is free forever, MIT licensed
Runs entirely on your machine. No cloud. No telemetry. License validation is offline. We can't see your data because we never touch it.
Findings are risk-scored and ranked so you fix what matters first. Suppress accepted-risk or false-positive findings with the operator workflow — your triage decisions persist across scans.
OpenAI, Claude, or Ollama (fully local). Compliance reports, remediation guidance, risk prioritization. Your API keys, your data.
27 CE plugins: Ports, SSH, HTTP, TLS, DNS, SNMP, SMB, RPC, mDNS, UPnP, and more. 29 EE plugins, of which 28 are cloud auditors: AWS S3, GCP, Azure, IAM Deep Auditor, CloudTrail, API Gateway, DynamoDB, KMS, Lambda, Secrets+SSM, CodePipeline, IAM Decrypt-Path, S3 Lifecycle, AWS Backup, RDS, SES, VPC/PrivateLink, EC2 SG, ElastiCache, Inspector2/GuardDuty, plus dedicated Azure Storage / NSG perimeter / Key Vault deep auditors, and more. The 28th, Zero Trust Assessment, is not a cloud auditor — it scores zero-trust posture from a network-host scan and calls no cloud API.
SOC 2 (AICPA TSC 2017), HIPAA Security Rule §164.312, NIST CSF 2.0, PCI DSS v4.0.1, ISO/IEC 27001:2022, CIS Critical Security Controls v8, GDPR Article 32 (Security of Processing), and NIST SP 800-171 Rev 2 — all from one scan. Sub-requirement-level mapping for QSA RoC workflow. Defined-vs-Customized Approach discipline per Appendix E. CHD Scope operator-attested. ISO 27001 Statement of Applicability discipline. CIS Implementation Group cumulative discipline (IG1 cyber-insurance baseline). GDPR Article 32 is an infrastructure substrate for Art. 32 only (4 covered + 5 partial + 2 OOS across 11 sub-measure units) — NOT GDPR compliance. Auditor-ready evidence packs with SHA-256 chain-of-custody. Zero BAA required.
The MCP server ships free in the Community Edition — drive NSAuditor from Claude Desktop, Claude Code, Cursor, or any MCP-aware agent. Add it to your claude_desktop_config.json (npx nsauditor-ai-mcp), then install the optional agent skill so the assistant knows NSAuditor's tools, schemas, and audit workflows — in Claude Desktop: Skills → Create skill → Upload a skill (upload SKILL.md). Then just ask: "audit my AWS account."
DocumentDB answers the same AWS APIs as RDS, and that shared control plane hid a real blind spot: a DocumentDB cluster with storage encryption disabled could read clean under the RDS auditor’s Aurora-only filter. The new 1230 AWS DocumentDB Auditor owns the docdb engine across seven dimensions — storage encryption with KMS key custody, TLS via the tls cluster parameter, audit logging with the CloudWatch export, backup retention, deletion protection, replica/AZ availability topology under the cluster lens DocumentDB actually uses, and whether manual cluster snapshots are restorable publicly or by accounts you did not intend. The RDS auditor now engine-filters DocumentDB and Neptune off the shared plane with a standing disclosure that a Neptune estate is unaudited. Verified live against paired fixtures — before the fix, 26 of 26 findings misattributed DocumentDB under RDS vocabulary; after it, zero. See a sample scan →
All eight coverage matrices are unchanged — SOC 2 10/4/37 · HIPAA 7/3/45 · NIST CSF 13/10/83 · PCI DSS 19/9/39 · ISO 27001 17/14/62 · CIS v8 17/23/113 · GDPR Art. 32 4/5/2 · NIST SP 800-171 Rev 2 2/49/59. The 1230 DocumentDB auditor routes to already-covered controls, so it is evidence depth, not new coverage. The plugin count is now 29 EE (56 in total), of which 28 are cloud auditors across AWS, Azure and GCP; the 29th, Zero Trust Assessment, scores posture from a network-host scan and calls no cloud API. All 29 install and load active.
0.40.0: the eighth compliance framework — NIST SP 800-171 Rev 2 as evidence substrate for CMMC Level 2 preparation, all 110 Rev 2 requirements enumerated at the SP 800-171A determination-statement level. 0.40.3: the evidence chain checks itself — on the opt-in RFC 3161 path every timestamp token is matched against the exact artifact digest it attests before anything is written, and the verification instruction on the report cover page runs exactly as printed. 0.38.0: an evidence pack can be signed — compliance sign-pack signs one framework’s chain-of-custody envelope with an operator-held Ed25519 key, and compliance verify-pack establishes authorship and then recomputes every artifact hash against disk, because checking the signature alone would authenticate a manifest whose artifact claims nothing had verified. 0.37.0: vulnerability data you can carry onto a network that cannot fetch it — feed bundle merges the NVD files you downloaded, feed import ingests them on the isolated host. 0.36.0: a report stopped taking an approval record at its word and began checking the signature against the approver’s registered key material, with verified and cryptoValid kept as separate questions so a revoked key makes them disagree. 0.35.0: suppression approvals got a command line — an accepted risk carries an owner, a rationale, a date and an expiry. Full changelog →