NSAuditor AI Enterprise Edition

EE 0.40.1 / CE 0.2.45. This is the first Marketplace version carrying EE 0.40.0's cargo: 0.40.0 was never published as a delivery option, so both releases are described here.

NEW - AN EIGHTH FRAMEWORK: NIST SP 800-171 Rev 2, shipped as "NIST SP 800-171 evidence substrate for CMMC Level 2 preparation" and never as anything stronger. Not a claim of CMMC certification, compliance or readiness; not FedRAMP authorization; never a MET or NOT MET verdict on a requirement; never an SPRS score. A Level 2 certificate is issued to a contractor by a C3PAO, and FedRAMP authorizes cloud service offerings, which this product is not.

All 110 Rev 2 requirements are enumerated - 2 covered, 49 partial, 59 out of scope - rather than a declared subset, so there is no under-enumeration surface. That only 2 are covered is the headline rather than an apology: SP 800-171A decomposes the 110 requirements into 320 assessment objectives, one objective scored NOT MET fails its whole requirement, and almost every requirement retains an objective about a defined procedure, an identified set or an organization-defined parameter that configuration cannot evidence. Each mapped requirement records its assessment objectives and the subset this engine supplies EXAMINE-method material for, and partialBasis names which of three shortfalls applies, because "partial" otherwise hides three genuinely different situations.

Two numbers were deliberately NOT shipped: a per-requirement SPRS weight and a basic/derived label. Both were transcriptions this repository cannot re-derive from an authority it holds, and an adversarial review disputed specific values in each. A per-requirement weight is also the multiplicand of the deduction arithmetic, so publishing it hands a reader the implied score the doctrine forbids. Removed rather than guessed.

Rev 2 is pinned because CMMC assesses Rev 2 by rule; Rev 3's 97 requirements with organization-defined parameters are a different universe, and Rev 3 numbering in a Rev 2 citation is drift rather than currency. Which systems process CUI remains the operator's assertion - the scanner cannot see CUI, cannot distinguish FCI from CUI, and cannot define an enclave boundary. The SSP and the POA&M are the artifacts an assessment is conducted against, and stay operator-side.

Its requirement ids collide exactly with PCI DSS sub-requirement ids - 3.5.1 is real in both, the first time two shipped frameworks share a literal id string. Both abstain from the id-sanitizer's shape table with the reason declared, and every citation carries its qualifier.

CHANGED - A KEY YOU MAY NOT CONTROL IS NO LONGER REPORTED AS CUSTOMER KEY CUSTODY. Read this before upgrading, because it changes what your reports say. Four plugins decided encryption-key custody from the key identifier's shape alone, so an alias ARN in a different AWS account, or a CMEK naming a different GCP project, read exactly like your own and the scan emitted positive audit evidence asserting the key was under customer control. Fixed in RDS, SQS/SNS, DynamoDB and GCP Cloud Storage; the finding now names both the key's account or project and the resource's, so you can confirm the arrangement rather than take a colour on trust. A foreign scope is an evidence gap and never a violation: a central key account is a recommended architecture, so a rule that failed on it would raise false positives against the layout the cloud vendors themselves advise. What you will see change: buckets, tables, queues, topics and databases whose key lives in another account or project move from PASS to a LOW evidence gap. Same-scope keys are untouched. Azure storage accounts are not covered - a vault URI carries the vault name only, with no subscription or tenant id, so establishing custody needs a separate Key Vault lookup with a new permission and a new denied-call failure mode. Boarded rather than half-implemented, because a check that silently cannot fire reads like coverage.

No finding routes to a different control as a result of this change, across all eight frameworks: these emissions are matched on stable prefixes, and the one anchor that had pinned the old reason text (GCP) was widened so the same findings route identically.

0.40.1 - 27 PHANTOM PLUGIN IDS OUT OF CUSTOMER-FACING PROSE. Compliance reports shipped identifiers naming no plugin. EE plugin ids are 1000+ and every instance was the real plugin with its leading 1 missing, including the instruction "Run plugin 040 (aws-cloudtrail-auditor) in the same scan" - a published instruction an operator cannot follow, sitting inside a finding's own remediation text. 24 occurrences in framework data and 3 in plugin emission strings. Verified against real output in stages rather than by inspection: the same estate re-scanned with the build patched incrementally went 42 phantom ids to 8 to 0, and the 42-to-8 step is the one worth keeping, because a data-only patch read as finished while a fifth of the defect lived in plugin code. A guard now derives the valid id set from the plugins on disk, so a dropped digit and an invented id are caught alike.

Plugin catalog UNCHANGED at 28. All seven pre-existing coverage matrices UNCHANGED (SOC 2 10/4/37, HIPAA 7/3/45, NIST CSF 13/10/83, PCI DSS 19/9/39, ISO 27001 17/14/62, CIS v8 17/23/113, GDPR Art. 32 4/5/2); NIST SP 800-171 is introduced at 2/49/59.

Requires nsauditor-ai >= 0.2.45. The floor is RAISED this cycle and derived from the CE version that ships the eighth framework's stem, not from a sibling working tree: published CE 0.2.44 does not carry it, so 0.40.x paired with 0.2.44 rejects the framework name. This image bakes CE 0.2.45.