nsauditor-ai 0.1.73 โ 0.1.74
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +6 -5
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -17,10 +17,11 @@ NSAuditor AI is the open-source core of a privacy-first security intelligence pl
|
|
|
17
17
|
|
|
18
18
|
## What's New
|
|
19
19
|
|
|
20
|
-
**Latest: CE 0.1.
|
|
20
|
+
**Latest: CE 0.1.74 + Enterprise 0.12.0** (May 2026)
|
|
21
21
|
|
|
22
|
-
- ๐ **
|
|
23
|
-
- ๐ณ **
|
|
22
|
+
- ๐ **ISO/IEC 27001:2022** (ISO + IEC, October 2022 โ 2013 edition retired October 31, 2025) is now the fifth supported compliance framework in Enterprise โ alongside SOC 2, HIPAA, NIST CSF 2.0, and PCI DSS v4.0.1. Per-Annex-A-code mapping (auditor-canonical for ISO/IEC 17021-1 certification body assessors walking Stage 1 / Stage 2 / annual surveillance / 3-year recertification): 17 covered + 14 partial + 62 OOS across 93 Annex A controls โ the complete Annex A universe across 4 themes (A.5 Organizational 37 + A.6 People 8 + A.7 Physical 14 + A.8 Technological 34). 11 NEW 2022 controls explicitly enumerated (3 covered + 2 partial + 6 OOS). Statement of Applicability per Clause 6.1.3.d discipline + ISMS Clauses 4-10 OOS-by-design framing + 5-attribute taxonomy. Generate evidence for any combination from a single scan: `--compliance soc2,hipaa,nist-csf,pci-dss,iso-27001` (Enterprise only).
|
|
23
|
+
- ๐ณ **PCI DSS v4.0.1** (added in EE 0.11.0) โ Defined-vs-Customized Approach discipline per Appendix E. CDE scope operator-attested. Card-brand AOC enforcement priority view (Visa CISP / Mastercard SDP / Amex DSOP / Discover DISC).
|
|
24
|
+
- ๐ **Statement of Applicability per Clause 6.1.3.d discipline** for ISO 27001:2022 โ engine produces substrate for INCLUDED controls; SoA inclusion/exclusion is operator-side. **ISMS Clauses 4-10 OOS-by-design** with 7 Major Nonconformity classes (absence of internal audit per Clause 9.2 or management review per Clause 9.3 = auto-fail Stage 2). Skill #18 `audit-iso-27001-2022-statement-of-applicability` authored 2026-05-24 via /skill-creator (Per-Framework Adversarial-Audit Skill Pairing institutional pattern).
|
|
24
25
|
- โก **NIST Cybersecurity Framework 2.0** (added in EE 0.10.0) โ 13 covered + 10 partial + 83 OOS Subcategories across 106 of CSF 2.0's 107 Subcategories.
|
|
25
26
|
- ๐ฅ **HIPAA Security Rule ยง164.312** (added in EE 0.9.0) โ Zero BAA required; your ePHI never leaves your infrastructure.
|
|
26
27
|
- โ๏ธ **24 cloud plugins** across AWS, Azure, GCP โ fully integrated SOC 2 / HIPAA / NIST CSF 2.0 / PCI DSS v4.0.1 evidence pipeline (Enterprise).
|
|
@@ -66,7 +67,7 @@ If you're heading into a **SOC 2, HIPAA, NIST CSF 2.0, or PCI DSS audit** โ or
|
|
|
66
67
|
- ๐ **Native GRC platform integration** โ push evidence directly to **Vanta** (live; Drata + Secureframe planned). Idempotent retries, per-tenant token rotation, rate-limit handling, signed-envelope round-trip integrity.
|
|
67
68
|
- ๐๏ธ **WORM evidence storage** โ S3 Object Lock COMPLIANCE-mode for SEC Rule 17a-4(f) / FINRA 4511 retention compliance
|
|
68
69
|
- ๐ **SLA / MTTR tracking + recurring-scan attestation** โ the **Type II operating-effectiveness evidence** auditors actually demand (not just point-in-time snapshots)
|
|
69
|
-
- ๐ฏ **
|
|
70
|
+
- ๐ฏ **9 adversarial-audit Claude Code skills** authored per the Per-Framework Adversarial-Audit Skill Pairing institutional pattern โ Phase-4 Compliance/GRC chain 6-of-6 COMPLETE for shipped + in-flight frameworks (SOC 2 + HIPAA + NIST CSF + PCI DSS + ISO 27001 + GRC connector)
|
|
70
71
|
|
|
71
72
|
โ **[See sample EE scan output](https://www.nsauditor.com/ai/docs/sample-scan/)** โ full evidence pack against synthetic Acme Corp AWS account (no signup required)
|
|
72
73
|
โ **[Buy NSAuditor AI Enterprise Edition](https://www.nsauditor.com/ai/pricing/)** โ $2k / $5k / $10k+ per year for 5 / 25 / unlimited seats + custom SLA. Onboarding call included.
|
|
@@ -572,7 +573,7 @@ nsauditor-ai --version (or -v, or `version`)
|
|
|
572
573
|
| `--interval <min>` | Rescan interval in minutes (requires `--watch`) | `60` |
|
|
573
574
|
| `--webhook-url <url>` | Webhook URL for delta alerts | โ |
|
|
574
575
|
| `--alert-severity <sev>` | Minimum severity for webhook alerts | `high` |
|
|
575
|
-
| `--compliance <fw>` | Compliance framework to map findings into. Accepts CSV for multi-framework runs (e.g. `soc2`, `hipaa`, `nist-csf`, `pci-dss`, or any combination like `soc2,hipaa,nist-csf,pci-dss`). **Enterprise license required.** Supported frameworks as of EE 0.
|
|
576
|
+
| `--compliance <fw>` | Compliance framework to map findings into. Accepts CSV for multi-framework runs (e.g. `soc2`, `hipaa`, `nist-csf`, `pci-dss`, `iso-27001`, or any combination like `soc2,hipaa,nist-csf,pci-dss,iso-27001`). **Enterprise license required.** Supported frameworks as of EE 0.12.0: `soc2` (AICPA TSC 2017) + `hipaa` (HIPAA Security Rule ยง164.312 Technical Safeguards) + `nist-csf` (NIST Cybersecurity Framework 2.0 Core, CSWP 29 Feb 2024) + `pci-dss` (PCI DSS v4.0.1, PCI SSC June 2024 errata) + `iso-27001` (ISO/IEC 27001:2022, ISO + IEC October 2022). See `@nsasoft/nsauditor-ai-ee` README for per-framework coverage details. | โ |
|
|
576
577
|
| `--compliance-scope <path>` | Optional JSON file describing the assessment scope (passed to the compliance engine for cover-page attestation) | โ |
|
|
577
578
|
| `--help`, `-h` | Print usage block (subcommands, flags, env vars, examples) and exit 0 | โ |
|
|
578
579
|
| `--version`, `-v` | Print `nsauditor-ai <version>` and exit 0 | โ |
|