AuditKit v0.8.7

A maintenance release that fixes how AuditKit reports its own version. There are
no changes to the scanners, the control catalogs, or the reports - coverage is
identical to v0.8.6.

Every defect below was in version reporting rather than in scanning, so a v0.8.6
install produces the same findings as v0.8.7. Upgrade to get an accurate answer
from auditkit version and a working update check.

Fixes

auditkit update reported the wrong installed version

pkg/updater carried its own CurrentVersion = "v0.3.0" constant. Nothing
overrode it at build time, because the -ldflags -X injection targets
main.CurrentVersion, so the value shipped as written.

The visible effect was that every release told every user they were running
v0.3.0:

New version available: v0.8.6 (you have v0.3.0)

That message appeared even on a freshly installed, fully up-to-date binary. The
updater now takes its version from main at startup instead of holding a second
copy that could drift.

Version comparison was lexical, not numeric

The same update check compared versions as strings. String ordering puts
v0.9.0 above v0.10.0, so the first double-digit minor release would have
silently stopped the update notice from ever firing again - a latent defect that
would have surfaced at v0.10.0 and been hard to attribute.

Versions are now compared numerically, component by component, with a
regression test covering the double-digit case.

Provider binaries baked in a stale version

The three provider-specific entry points (auditkit-aws, auditkit-azure,
auditkit-gcp) were pinned at v0.8.5 in source while the universal binary
said v0.8.6, and the Makefile passed no -ldflags at all. Both make build-aws and the go build command documented in the README therefore
produced binaries reporting a stale version regardless of the checked-out tree.

All four entry points now agree, and the Makefile derives the version from
git describe so a local build reports what was actually built.

Verification

The published archives were checked by extracting the binaries and querying
them, rather than by trusting the build:

• All four Linux binaries report v0.8.7 from auditkit version
• The stale v0.3.0 string is absent from the universal binary
• auditkit update against the live release feed reports
  You're on the latest version (v0.8.7)
• All 20 archive checksums verify against auditkit-checksums.txt

Upgrading

Replace the binary. There is no configuration, cache, or report-format change,
and no reason to re-run a scan you have already collected.

AuditKit Community Edition v0.8.6

Coverage rebaseline and stability pass. The scanner now reports the full control
list each framework defines, rather than only the controls it automates, so a
scan shows the complete assessment scope from the start.

Changed

CMMC reporting covers all 110 practices

A CMMC scan now lists every Level 1 and Level 2 practice. Level 1 is the
automated set - 13 of the 17 practices carry checks - and 8 Level 2 practices
are automated on GCP. Every remaining practice is reported with
evidence-collection guidance describing what an assessor needs to see.
Automated Level 2 coverage across all three providers, and assessor-ready
evidence package generation, are AuditKit Pro capabilities.

Framework catalogs embedded

Every supported framework now ships its full control list, so the denominator in
a report is the standard's own:

Controls without an automated check are reported as such, with evidence guidance,
instead of being omitted.

FedRAMP baselines derive from NIST 800-53

Baseline membership is taken from the published Low, Moderate and High baselines
rather than a hand-maintained subset.

Derived-framework scans run the full check set

Scans for 800-53, ISO 27001, NIST CSF, GDPR, HIPAA and the FedRAMP baselines now
execute the complete check set, widening the controls each can reach through the
framework crosswalk.

Fixed

• PCI DSS scans now run the RDS checks. A PCI scan previously returned no RDS
  evidence at all, so requirement 3.5.1 (stored account data encrypted) and
  1.4.2 (no direct public network access) were silently unassessed on accounts
  running RDS.
• Detailed remediation commands now reach the report. RemediationDetail was
  populated by the checks but dropped on the way to the PDF and HTML writers, so
  findings showed the one-line summary without the commands that fix them.

Refinements

• CIS coverage rebaselined: 158 AWS, 108 Azure and 71 GCP recommendations
• HIPAA catalog aligned to the published Security Rule, and two crosswalk
  mappings realigned to the correct paragraphs
• Control identifiers normalised across providers
• Offline mode resolves a cached scan when the account id is not known in advance
• Documentation rebaselined against the code across the README, SECURITY.md and
  the whole site. Coverage figures now come from the catalogs; setup guides list
  the permissions the checks actually call (the AWS policy needed
  s3:ListAllMyBuckets, Azure needed Microsoft Graph, GCP needed container.*
  and bigquery.*); and the build requirement is Go 1.24, matching go.mod.
  Microsoft 365 is described as a ScubaGear import rather than a scanned
  provider, which is what -provider accepts.

Upgrade

Replace the binary. No configuration changes. Expect a CMMC scan to report 110
practices where it previously reported 17; the automated Level 1 findings are
unchanged.

AuditKit v0.8.5

Release date: 2 September 2026

Hotfix for v0.8.4. The binaries published for v0.8.4 were built before the CMMC
corrections below had been made, so they report practice identifiers that do not
match the standard. Everything else in v0.8.4 is unchanged and still applies;
read those notes first if you are coming from v0.8.3 or earlier.

CMMC practice identifiers

A CMMC practice identifier is fully determined: the family prefix follows from
the control number, and the level follows from whether the control is one of the
17 in FAR 52.204-21. Ten identifiers followed neither, all of them claiming
Level 1 for controls that are Level 2:

PE.L1-3.10.2  ->  PE.L2-3.10.2
PE.L1-3.10.6  ->  PE.L2-3.10.6
PS.L1-3.9.1   ->  PS.L2-3.9.1
PS.L1-3.9.2   ->  PS.L2-3.9.2

Because those four were labelled Level 1, the scanner appeared to cover all 17
Level 1 practices. It covers 13. That is the number now reported and documented.

The crosswalk was worse. Six keys carried the wrong level or family, four of them
under RE.L2-3.13.x, and RE is not a family at all; those controls belong to SC.
One key was not in 800-171 Rev 2. Canonicalising them merged four duplicate pairs
and dropped the invalid one, so controls that previously derived nothing now
resolve. NIST 800-53 coverage is 96 controls, up from 94, for that reason rather
than any new check.

.github/scripts/check-cmmc.py rejects any non-conforming identifier, in both
the Control field and the framework tags, and runs in CI.

Documented coverage is now derived from the code

Every count the documentation states is a property of the checks and the
crosswalk. .github/scripts/coverage-counts.py computes them and fails CI if any
documented claim disagrees, against 61 declared claims.

Writing it found that 144, the NIST 800-53 total published in v0.8.4, counted
every control named anywhere in the crosswalk, including entries no check can
reach. Four more numbers were understated on AWS because the earlier measurement
missed criteria written in the Control field, which the scanner does read.

NIST 800-53 total   144 -> 96
NIST 800-53 AWS      77 -> 88
NIST CSF AWS         75 -> 87
ISO 27001 AWS        46 -> 48
GDPR AWS             13 -> 14

Documentation

GDPR and NIST CSF 2.0 have pages for the first time. Both frameworks started
returning results in v0.8.4 and neither was documented; both pages are explicit
about the limit of what a configuration scan can say, which for GDPR is Article
32 and parts of 25, 30 and 33, and for CSF excludes Govern entirely.

The site claimed AWS 90+ checks, Azure 64+ and GCP 170+ against 229, 178 and 135;
CIS as AWS 126+, Azure ~40+ and GCP 61 against 125, 108 and 26; and HIPAA as
experimental with ~10 controls against 17 safeguards. The published sample report
and the Azure Arc page still cited PCI DSS v3.2.1 requirement numbers that v0.8.4
renumbered, so cross-referencing either against a scan would have matched nothing.

The navigation led with CMMC, which described a tool that assesses nine
frameworks. It now leads with a frameworks index listing all of them. The
homepage banner claimed all new DoW contracts require CMMC compliance; Phase 1
requires self-assessment and Phase 2 was suspended on 13 July 2026, which is what
it says now.

Upgrade

Replace the binary. No configuration changes. If you ran v0.8.4, your CMMC
control identifiers will change and Level 1 coverage will read 13 of 17 rather
than 17 of 17. Nothing regressed; the previous labelling was wrong.

AuditKit v0.8.4

Release date: 1 September 2026

Read this before upgrading

Your compliance score will go down, and that is the point of this release.

A control the scanner could not evaluate used to be counted as if it had passed.
Scanning an account with no RDS instances produced "all RDS instances are
encrypted" and scored it as a pass. So did an account where the scanner lacked
the permission to look. On the AWS account used to validate this release, the
reported score fell from 55.0% to 30.8% with no change to the account
itself. The second number is the accurate one.

If your score drops after upgrading, nothing regressed in your environment.
The previous number was counting absences as evidence.

Scoring and check accuracy

• Controls for resource types an account does not use are reported as INFO and
  excluded from the score, rather than passing vacuously. 89 checks were
  affected.
• A check that could not read a resource no longer reports a verdict about it.
  S3 classification treated any tagging error as "unclassified", so an account
  missing s3:GetBucketTagging, or with buckets in another region, failed the
  control outright. The same pattern is fixed in the Azure storage checks.
• Azure blob soft delete was assessed inside the lifecycle-policy branch, so a
  failure to initialise the policy client produced "all N accounts have soft
  delete enabled" without a single API call.
• Only PASS and FAIL contribute to the score. INFO, MANUAL and ERROR are
  excluded rather than counted as failures, and an unrecognised status can no
  longer distort the result. Check statuses are now a fixed set enforced in CI.
• A scan that evaluates nothing exits non-zero instead of reporting 0%.
• An absent autoscaler is a manual check, not a scored failure. A project
  running only serverless workloads was being penalised for a resource type it
  does not use.

Framework mappings

Most PCI requirements a scan emitted derived no NIST 800-53 controls at all,
which meant they were also missing from the ISO 27001, GDPR, NIST CSF and
FedRAMP output derived from it. Three separate causes, all fixed:

• Checks wrote requirements two ways, bare (5.2.1) and prefixed
  (Req 5.2.1), but the lookup only built a key from the bare form.
• The v4.0.1 renumbering updated each check's control id but left the framework
  tag on the old v3.2.1 number.
• The crosswalk had no entries for 25 requirements checks legitimately emit.

The SOC2 side of the crosswalk never split multi-value tags, so a check
declaring CC6.1, CC6.6 had the whole string looked up as one key and resolved
to nothing. The Azure CC6 summary declared the range CC6.1-CC6.8, which could
never have matched.

PCI requirements resolving to 800-53: 19 of 97 before, 69 of 69 after.
SOC2 criteria: 38 of 38. NIST 800-53 coverage is 144 controls.

Mappings corrected to match what the service actually does:

GuardDuty at 11.5.1 was already correct and is unchanged. No part of AuditKit
can evidence an ASV scan, so 11.3.2 was unsatisfiable by construction.

New coverage

• SOC2 Availability and Confidentiality criteria: A1.1, A1.2, A1.3, C1.1 and
  C1.2, on AWS, Azure and GCP.
• PCI DSS v4.0.1 requirements that became mandatory on 31 March 2025: 4.2.1.1,
  8.6.1, 8.6.2, 8.6.3, 10.4.1.1, 10.7.2 and 10.7.3, on all three providers.
• GDPR and NIST CSF 2.0 now return results. Both previously returned nothing.
• Azure 8.6.1, 8.6.3 and 10.4.1.1 are automated rather than manual.

Evidence lifecycle

Evidence collection is now durable and tracks staleness.

• auditkit evidence status shows what is outstanding and what has gone stale
• auditkit evidence collect CONTROL-ID records a collection with notes,
  artefact path and collector
• auditkit evidence import PROGRESS.json imports progress from the HTML
  checklist

Evidence older than 90 days is reported as stale. evidence import never
worked in any prior build: it consumed its own path argument during flag
parsing and exited 1 on every invocation.

Fixes

• PCI password length check demanded 12 characters while its remediation told
  you to set 7, so following the generated fix left the control failing.
• The EC2 "no instances to assess" result carried a framework key that does not
  exist, so it never reached a report.
• SOC2 A1.2 vanished entirely from empty Azure subscriptions.
• The evidence tracker stamped "Security Control" over every control name it
  did not recognise.
• go vet and go test ./... pass; vet, test, build, a check-status guard and
  a documentation link check all run in CI.

Documentation

The site claimed features that do not exist. The evidence command was
documented with -format text|html|excel and an evidence-tracker.xlsx
example; there is no Excel support anywhere in AuditKit and the command accepts
neither flag. CSV export is real, via scan -format csv.

Control counts were corrected against the code: GCP 135, Azure 178, PCI DSS 69
requirements, NIST 800-53 144. The compliance score definition now explains what
is excluded from it.

Upgrade

No configuration changes are required. Re-run your usual scan and expect a lower,
more accurate score.

AuditKit v0.8.3 Release Notes

Release Date: August 18, 2026

What's Changed

This release fixes a reporting defect that affected every generated PDF and HTML
report, and repairs the binary download links, which had been returning 404.

Report Accuracy (important)

• Compliance scores now agree between the CLI and the generated reports.
  Controls with MANUAL status were counted in the report's denominator but can
  never pass, so the score printed in a PDF or HTML report came out lower than the
  score the CLI had just shown for the same scan. The PDF disclaimer printed both
  numbers in a single sentence as though they matched.
• Manual controls now appear in reports. 45 controls with MANUAL status were
  omitted entirely from the PDF evidence guide and the HTML report. They were
  neither scored nor listed, so the evidence they require was invisible to anyone
  working from the report.
• M365 scans score on the same basis as every other provider. The M365 path
  divided by the total control count instead of the automated count, producing a
  third scoring formula within the same product.

If you compare a v0.8.3 report against an older one, the score will usually be
higher. Nothing about your environment changed - manual controls are no longer
counted as automated failures. The set of passing and failing technical checks is
unchanged.

Downloads and Installation

• Fixed every binary download URL. The installation guide pointed at asset
  names that do not exist (auditkit-linux-amd64 rather than
  auditkit-linux-amd64.tar.gz), so all three platform commands returned 404. The
  Markdown installation guide was still pinned to v0.7.0, and all 16 CI/CD examples
  (GitHub Actions, GitLab CI, Jenkins, Dockerfile) had the same broken pattern.
• Release archives no longer embed the version in the filename. Assets are now
  auditkit-linux-amd64.tar.gz rather than auditkit-v0.8.3-linux-amd64.tar.gz,
  so releases/latest/download/<name> resolves correctly and keeps working across
  future releases. The version is carried by the release tag and reported by the
  binary itself.
• Added Linux ARM64 and Apple Silicon instructions, including Linux VMs running
  on Apple Silicon Macs.
• Corrected the documented binary size. The universal binary is ~59 MB
  compressed and ~302 MB installed; the docs claimed ~15 MB. Single-cloud builds
  (~6-11 MB) are now documented as the lighter option.

Versioning

• Provider-specific binaries report the correct version. auditkit-aws,
  auditkit-azure, and auditkit-gcp were pinned at v0.7.0 and had never been
  bumped.
• The version is now injected at build time via -ldflags. It previously targeted
  main.Version, a symbol that does not exist, while the code used a const that
  -ldflags cannot overwrite - so the flag silently did nothing.

Build Health

• go vet and go test ./... pass again. A fmt.Sprintf in the GCP manual checks
  had arguments but no formatting directives, which failed vet and blocked the test
  build for pkg/gcp/checks. The dropped argument was the project ID, which should
  have appeared in the evidence guide.

Upgrading

No configuration changes are required. Replace the binary and re-run your scans.

Expect reported scores to rise if your scans include manual controls. The
underlying pass/fail results are unchanged.

Downloads

Asset names are stable across releases:

Universal Scanner (all providers)

Single-Cloud Scanners

Replace auditkit with auditkit-aws, auditkit-azure, or auditkit-gcp in any
filename above. These are 6-11 MB rather than ~59 MB.

Verify downloads against auditkit-checksums.txt.

Release Date: February 17, 2026

What's Changed

Accuracy & Honesty Fixes

This release removes overclaimed features, fixes broken documentation, and ensures everything we advertise actually works.

• Removed stubbed report command - The auditkit report command printed a "not yet implemented" message. Removed from CLI. Use auditkit scan -format pdf to generate reports.
• Fixed website "Core Features" labeling - Six Pro-only features were listed under "Core Features" with no Pro indication. Relabeled as "Pro Features" with subscription note.
• Fixed "Both included" messaging - Desktop GUI section implied the GUI ships with the free edition. Clarified: "Both included with AuditKit Pro."
• Fixed drift-check command syntax - Website showed incorrect syntax. Updated to match actual CLI usage.
• Updated HIPAA control count - FAQ listed ~10 controls; actual count is ~15 across AWS, Azure, and GCP.

Documentation Cleanup

• Removed fictional Docker section - Installation docs advertised Docker support "Coming Soon" with no Dockerfile in the repo. Removed entirely.
• Removed overclaimed Pro report features - FAQ listed "Company branding" and "Custom evidence fields" as coming soon with no backing code. Removed.
• FedRAMP baseline filtering works - Docs labeled fedramp-low, fedramp-moderate, fedramp-high as "coming soon" but the feature was fully implemented. Updated docs to reflect this.
• Fixed sample report placeholder - Example SOC2 report contained "S3 logging check placeholder" text. Replaced with realistic evidence output.

Build Improvements

• Provider-specific binaries now included in releases - auditkit-aws, auditkit-azure, and auditkit-gcp are now built and published alongside the universal binary. Smaller downloads for single-cloud environments and faster CI/CD pipelines.

Code Cleanup

• Removed unused NotImplemented constant from Azure checks
• Fixed misleading "placeholder" comment in Azure identity check (it's a legitimate manual review check)

Downloads

Universal Scanner (all providers)

AWS-Only Scanner

Azure-Only Scanner

GCP-Only Scanner

Installation

# Universal (all providers)
tar -xzf auditkit-v0.8.2-linux-amd64.tar.gz
chmod +x auditkit-linux-amd64
./auditkit-linux-amd64 version

# AWS-only (90% smaller)
tar -xzf auditkit-aws-v0.8.2-linux-amd64.tar.gz
chmod +x auditkit-aws-linux-amd64
./auditkit-aws-linux-amd64 scan -framework soc2

# Azure-only
tar -xzf auditkit-azure-v0.8.2-linux-amd64.tar.gz
chmod +x auditkit-azure-linux-amd64
./auditkit-azure-linux-amd64 scan -framework soc2

# GCP-only
tar -xzf auditkit-gcp-v0.8.2-linux-amd64.tar.gz
chmod +x auditkit-gcp-linux-amd64
./auditkit-gcp-linux-amd64 scan -framework soc2

SHA256 Checksums

ef1accc4f7acf62397e0b84918a14266e84dd7eaa4ec974ea89934f7cb7a7d7e  auditkit-v0.8.2-linux-amd64.tar.gz
9b0be75a35822f76684aee21adbe71c2766fc7fea8647799b2cd3957fbecd3d0  auditkit-v0.8.2-linux-arm64.tar.gz
19a0218f71aab3ab46dbf2deda34c9dad62472b2bd6b68987368f28fb1d8bb0a  auditkit-v0.8.2-darwin-amd64.tar.gz
445b9c7c93875edf1118d92970b4c2775b4e6f917de01d2f8f05f7c132b5f34f  auditkit-v0.8.2-darwin-arm64.tar.gz
a812be54b65f62787e3c41a2d6d970308f74cc1f45b9321a0917b5062cd4ffd0  auditkit-v0.8.2-windows-amd64.zip
1dbdb07fe4215cd6803e8cce8e1508f7e3fc14d9be0abb88814dfe9752cebb12  auditkit-aws-v0.8.2-linux-amd64.tar.gz
0b9939c718815fc6c3ef719ae8d4222cfa6a205823af0faa1e8f691827288d7e  auditkit-aws-v0.8.2-linux-arm64.tar.gz
91d2a6d84d140e475f6e37a2899d136abcd3793fe9d3acb09a27315fe788f338  auditkit-aws-v0.8.2-darwin-amd64.tar.gz
aa09c60e6e5615be460088455c91fad98767c114e00e45c9e651d3efcb7a18cc  auditkit-aws-v0.8.2-darwin-arm64.tar.gz
d9bda173d6d0013acc0af89e9f3feecc625c22b9c716f5a0e0f8fcd52c1d10b7  auditkit-aws-v0.8.2-windows-amd64.zip
cc3de62ae4401ddc44facc97ad6b89cf81cb45ace2f05a8a32294eb47c49c710  auditkit-azure-v0.8.2-linux-amd64.tar.gz
465f6ea9522623dfdf661f03c672e9008dd46b3534573e2371981446fc22e6dd  auditkit-azure-v0.8.2-linux-arm64.tar.gz
346a10fd7d79d60c3139ae20bbc7330e5067685525724c5da34ddfddea675562  auditkit-azure-v0.8.2-darwin-amd64.tar.gz
297703efa0e5af9ec43d290807adef3ab3d58cf1a94f30c9aa906d3356e0ce40  auditkit-azure-v0.8.2-darwin-arm64.tar.gz
dcda5095e6549188d370f592767f0fab4c0c63d82b5f2bc14bfcc70113ad0014  auditkit-azure-v0.8.2-windows-amd64.zip
cb8f8ec06d2a074962f5c6ab9c678692831ddeeb7cfdbac77223de5086a6a03e  auditkit-gcp-v0.8.2-linux-amd64.tar.gz
e90c437d88fe690a297ccdd7256043eb43ac3d60356c7e6489c01c3a31939c9e  auditkit-gcp-v0.8.2-linux-arm64.tar.gz
d6bf724824d9d9be62cc1b2db140671c97a85264d1d4eaee1e9fa7aaae4d145e  auditkit-gcp-v0.8.2-darwin-amd64.tar.gz
9063888ed41bdb9f02ec3a7759188bdaf1eae5de7a9c0c5e1287695842c9dd4d  auditkit-gcp-v0.8.2-darwin-arm64.tar.gz
b24650e90b8717399a3327915f7d11a069bc85827a46d31d3618797c3fd94bf9  auditkit-gcp-v0.8.2-windows-amd64.zip

Full Changelog: v0.8.1...v0.8.2

What's New in v0.8.1

Prowler Integration

Import Prowler scan results directly into AuditKit with automatic framework mapping.

# Run Prowler first
prowler aws --output-formats json -o prowler-output

# Import into AuditKit
auditkit integrate -source prowler -file prowler-output.json

# Generate PDF report from Prowler results
auditkit integrate -source prowler -file prowler-output.json -format pdf -output report.pdf

Supported:

• AWS, Azure, and GCP Prowler outputs
• Automatic cloud provider detection
• Framework mapping to SOC2, PCI-DSS, CMMC, HIPAA, NIST 800-53, CIS, and more
• All output formats (text, JSON, HTML, PDF)

Azure Fix Script Generation

Generate remediation scripts for Azure resources - completing support for all three major cloud providers.

# Generate Azure fix script
auditkit fix -provider aws      # Already supported
auditkit fix -provider gcp      # Already supported
auditkit fix -provider azure    # NEW in v0.8.1

Evidence Tracker HTML

Interactive HTML checklist for tracking evidence collection during audit prep.

Features:

• Progress bar showing collection status
• Pass/fail statistics dashboard
• LocalStorage persistence (progress saves across browser sessions)
• Notes field for each control
• Export to JSON for backup/sharing
• Print-friendly layout

auditkit evidence-tracker -provider aws -output tracker.html

Improvements

• Evidence tracker now persists progress in browser localStorage
• Prowler integration auto-detects AWS/Azure/GCP from scan results
• Updated all documentation to v0.8.1

Installation

Download the binary for your platform below and run:

chmod +x auditkit-*
./auditkit-linux-amd64 scan -provider aws -framework soc2

See CHANGELOG.md for complete version history.

What's New in v0.8.0

AWS Data Analytics & ML Services (24 new checks)

SageMaker (6 checks)

• Notebook instance encryption
• Direct internet access disabled
• Root access disabled
• Endpoint encryption
• Training job encryption
• Model network isolation

Redshift (7 checks)

• Cluster encryption at rest
• Audit logging enabled
• Public accessibility disabled
• SSL/TLS enforcement
• Backup retention (7+ days)
• Automatic minor version upgrades
• Enhanced VPC routing

ElastiCache (5 checks)

• Encryption at rest
• Encryption in transit
• Automatic minor version upgrades
• AUTH token enabled
• Backup retention

OpenSearch (6 checks)

• Encryption at rest
• Node-to-node encryption
• HTTPS enforcement
• VPC deployment
• Audit logging
• Fine-grained access control

Offline Mode

Run scans without cloud connectivity - essential for air-gapped and classified environments.

New Framework Mappings

• GDPR - 27 articles mapped via NIST 800-53 crosswalk
• NIST CSF - All 5 functions with 23 categories mapped

Improvements

• AWS service coverage increased from 64 to 90+ automated checks
• All framework remediation guidance updated to January 2026 standards
• CIS AWS Benchmark mappings updated to v3.0
• PCI-DSS v4.0 remediation updated for 2026 requirements
• HIPAA guidance updated for 2026 enforcement requirements

Installation

Download the binary for your platform below and run:

chmod +x auditkit-*
./auditkit-linux-amd64 scan -provider aws -framework soc2

See CHANGELOG.md for complete version history.

AuditKit v0.7.1 Release Notes

Release Date: December 14, 2025

Compliance Check Accuracy Fixes

This release focuses on fixing compliance check accuracy issues across all three major cloud providers.

GCP PCI-DSS

Connected the comprehensive PCI-DSS v4.0 implementation covering all 12 requirements. The implementation existed but was not being used by the scanner.

• Requirement 1: Network Segmentation (firewall rules)
• Requirement 2: Default Passwords (manual checks with guidance)
• Requirement 3: Storage Encryption (CMEK verification, key rotation)
• Requirement 4: Encryption in Transit (SQL SSL enforcement)
• Requirement 5: Malware Protection (guidance for endpoint protection)
• Requirement 6: Secure Systems (patching, SDLC, WAF)
• Requirement 7: Access Control (least privilege, IAM)
• Requirement 8: Authentication (MFA, session timeout, key rotation)
• Requirement 9: Physical Access (inherited controls documentation)
• Requirement 10: Logging (audit logs, 12-month retention)
• Requirement 11: Security Testing (ASV scans, pen testing, FIM)
• Requirement 12: Security Policy (policies, risk assessment, training)

Azure PCI-DSS

Connected the comprehensive AzurePCIChecks implementation. Previously, Azure PCI scans were using filtered basic checks instead of the dedicated PCI implementation.

AWS Credential Report

Fixed CSV parsing for IAM credential reports. The unused credentials check was returning empty results due to parsing errors when processing the credential report CSV.

Azure VM Public IP Detection

Added proper NetworkInterfaces and PublicIPAddresses client integration for accurate detection of VMs with public IP exposure. Previous implementation was incomplete and could miss exposed VMs.

Upgrade Instructions

Download the new binary for your platform and replace your existing auditkit binary.

# Verify version
./auditkit --version
# Should show: AuditKit v0.7.1

Checksums

See auditkit-v0.7.1-checksums.txt in the release assets.

Release Date: November 4, 2025

AuditKit now supports Google Cloud Platform (GCP) alongside AWS and Azure, making it the first open-source compliance scanner with unified coverage across all three major cloud providers.

What's New

Google Cloud Platform (GCP) Support

Scan GCP projects for SOC2, PCI-DSS, CMMC Level 1, NIST 800-53, ISO 27001, and CIS Benchmarks compliance.

Supported GCP Services:

• Cloud Storage (GCS) - Public access, encryption, versioning, logging
• Cloud IAM - Service account keys, MFA, primitive roles
• Compute Engine - Public IPs, OS patching, disk encryption, Shielded VM
• VPC Networks - Firewall rules, network segmentation, flow logs
• Cloud SQL - Public exposure, SSL enforcement, backups, encryption
• Cloud KMS - Key rotation policies, encryption at rest
• Cloud Logging - Audit logs, retention, export, log sinks
• GKE (Kubernetes Engine) - Binary authorization, network policies, dashboard access
• BigQuery - Dataset encryption, access controls

170+ automated security checks across these services.

Quick Start:

# Authenticate with GCP
gcloud auth application-default login
export GOOGLE_CLOUD_PROJECT=my-project-id

# Run SOC2 scan
./auditkit scan -provider gcp -framework soc2

# Generate PDF report
./auditkit scan -provider gcp -framework soc2 -format pdf -output gcp-soc2-report.pdf

New Compliance Frameworks

NIST 800-53 Rev 5

• ~150 automated technical controls across AWS, Azure, and GCP
• Covers FedRAMP Low/Moderate/High baseline requirements
• Essential for federal contractors and FedRAMP pursuits
• Framework crosswalk from existing SOC2/PCI/CMMC controls
• Use: -framework 800-53

ISO 27001:2022

• 93 total controls in the framework (54+ automated via crosswalk)
• Focus on Annex A technical controls (A.8)
• International information security standard
• Required for global enterprise sales and certifications
• Use: -framework iso27001

CIS Benchmarks

• AWS: 129 automated controls (combines CIS v1.4 and v3.0)
• Azure: 40+ automated controls (CIS Microsoft Azure Foundations v3.0)
• GCP: 56 automated controls (CIS Google Cloud Platform Foundations)
• Security hardening best practices beyond compliance checkboxes
• Proactive defense to reduce attack surface
• Use: -framework cis-aws, -framework cis-azure, -framework cis-gcp

Framework Coverage

All cloud providers now support the same frameworks with consistent reporting:

Enhanced Framework Coverage

PCI-DSS Completion

• All 12 requirements now fully documented across all clouds
• Added Requirements 2, 5, 6, 9, 11, 12 organizational controls
• Complete coverage with both automated and manual controls

HIPAA Production Ready

• AWS: 70 framework mappings
• Azure: 62 framework mappings
• GCP: 40 framework mappings
• Moved from experimental to production status for technical safeguards

CMMC Level 1 Verified

• All 17 official practices confirmed
• Complete coverage across AWS, Azure, and GCP
• Removed mislabeled Level 2 controls

CSV Export

Export compliance results to spreadsheet format for compliance teams:

./auditkit scan -provider gcp -framework soc2 -format csv -output results.csv

• Compatible with Excel and Google Sheets
• Includes: Control ID, Name, Status, Severity, Evidence, Remediation, Console URLs
• Proper CSV escaping for special characters

Provider-Specific Binaries

Choose the right binary for your environment:

Universal Binary (All Platforms)

• Supports AWS + Azure + GCP in one binary
• Available for: Linux (amd64, arm64), Windows (amd64), macOS (Intel, Apple Silicon)
• Size: ~280MB
• Best for: Multi-cloud environments, desktop usage, Windows/Mac users

Provider-Specific Binaries (Linux Only)

• auditkit-aws - AWS-only (20MB, 93% smaller)
• auditkit-azure - Azure-only (26MB, 91% smaller)
• auditkit-gcp - GCP-only (44MB, 84% smaller)
• Best for: CI/CD pipelines, Docker containers, single-cloud deployments

Important: Provider-specific binaries are available for Linux only. Windows and macOS users should use the universal binary.

Documentation Restructure

The README was getting unwieldy at 1000+ lines, so we reorganized:

Before: Everything crammed into README.md

After:

• docs/frameworks/ - One guide per framework (CIS, ISO 27001, NIST 800-53)
• docs/setup/ - Provider-specific authentication and setup
• docs/examples/ - CI/CD integration examples
• README.md - Clean overview with links to detailed docs

Installation

Universal Binary (Recommended for Windows/Mac)

Linux (amd64):

wget https://github.com/guardian-nexus/auditkit/releases/download/v0.7.0/auditkit-v0.7.0-linux-amd64.tar.gz
tar -xzf auditkit-v0.7.0-linux-amd64.tar.gz
chmod +x auditkit-linux-amd64
./auditkit-linux-amd64 scan -provider gcp -framework soc2

Linux (arm64):

wget https://github.com/guardian-nexus/auditkit/releases/download/v0.7.0/auditkit-v0.7.0-linux-arm64.tar.gz
tar -xzf auditkit-v0.7.0-linux-arm64.tar.gz
chmod +x auditkit-linux-arm64
./auditkit-linux-arm64 scan -provider aws -framework pci

Windows (amd64):

# Download auditkit-v0.7.0-windows-amd64.zip from releases
# Extract and run:
.\auditkit-windows-amd64.exe scan -provider azure -framework soc2

macOS (Intel):

wget https://github.com/guardian-nexus/auditkit/releases/download/v0.7.0/auditkit-v0.7.0-darwin-amd64.tar.gz
tar -xzf auditkit-v0.7.0-darwin-amd64.tar.gz
chmod +x auditkit-darwin-amd64
./auditkit-darwin-amd64 scan -provider aws -framework 800-53

macOS (Apple Silicon):

wget https://github.com/guardian-nexus/auditkit/releases/download/v0.7.0/auditkit-v0.7.0-darwin-arm64.tar.gz
tar -xzf auditkit-v0.7.0-darwin-arm64.tar.gz
chmod +x auditkit-darwin-arm64
./auditkit-darwin-arm64 scan -provider gcp -framework iso27001

Provider-Specific Binaries (Linux Only - CI/CD Optimized)

AWS Only (20MB):

wget https://github.com/guardian-nexus/auditkit/releases/download/v0.7.0/auditkit-aws-v0.7.0-linux-amd64.tar.gz
tar -xzf auditkit-aws-v0.7.0-linux-amd64.tar.gz
chmod +x auditkit-aws-linux-amd64
./auditkit-aws-linux-amd64 scan -framework cis-aws

Azure Only (26MB):

wget https://github.com/guardian-nexus/auditkit/releases/download/v0.7.0/auditkit-azure-v0.7.0-linux-amd64.tar.gz
tar -xzf auditkit-azure-v0.7.0-linux-amd64.tar.gz
chmod +x auditkit-azure-linux-amd64
./auditkit-azure-linux-amd64 scan -framework cis-azure

GCP Only (44MB):

wget https://github.com/guardian-nexus/auditkit/releases/download/v0.7.0/auditkit-gcp-v0.7.0-linux-amd64.tar.gz
tar -xzf auditkit-gcp-v0.7.0-linux-amd64.tar.gz
chmod +x auditkit-gcp-linux-amd64
./auditkit-gcp-linux-amd64 scan -framework soc2

GCP Authentication

Three authentication methods supported:

Option 1: Application Default Credentials (Recommended)

gcloud auth application-default login
export GOOGLE_CLOUD_PROJECT=my-project-id
./auditkit scan -provider gcp -framework soc2

Option 2: Service Account Key

export GOOGLE_APPLICATION_CREDENTIALS=/path/to/key.json
export GOOGLE_CLOUD_PROJECT=my-project-id
./auditkit scan -provider gcp -framework pci

Option 3: GCE Metadata (for Compute Engine)

# Automatically detected when running on GCE, just set project ID
export GOOGLE_CLOUD_PROJECT=my-project-id
./auditkit scan -provider gcp -framework cmmc

Required Permissions: roles/viewer or equivalent read-only access to your GCP project.

Usage Examples

Multi-cloud SOC2 assessment:

./auditkit-linux-amd64 scan -provider aws -framework soc2 -format pdf -output aws-soc2.pdf
./auditkit-linux-amd64 scan -provider azure -framework soc2 -format pdf -output azure-soc2.pdf
./auditkit-linux-amd64 scan -provider gcp -framework soc2 -format pdf -output gcp-soc2.pdf

GCP security hardening with CIS Benchmarks:

./auditkit-gcp-linux-amd64 scan -framework cis-gcp -format html -output gcp-hardening.html

NIST 800-53 assessment for FedRAMP:

./auditkit-linux-amd64 scan -provider aws -framework 800-53 -format csv -output nist-results.csv

ISO 27001 technical controls:

./auditkit-linux-amd64 scan -provider gcp -framework iso27001 -format pdf -output iso-report.pdf

PCI-DSS for payment processing:

./auditkit-linux-amd64 scan -provider azure -framework pci -format html -output pci-report.html

Example Output

AuditKit v0.7.0 - SOC2 Compliance Scan
======================================
Provider: GCP
Project: production-project-12345
Framework: SOC2 Type II Trust Services Criteria
Scan Date: 2025-11-04 10:30:00 UTC

Overall Compliance Score: 72.5% (29/40 controls passed)

CRITICAL - Fix These NOW:
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[FAIL] CC6.6 - User MFA Enforcement
       Evidence: 12 users without MFA enabled
       Remediation: gcloud iam policies set-iam-policy ...

[FAIL] CC6.2 - Public Storage Access
       Evidence: 3 GCS buckets allow public access
       Buckets: backup-prod, logs-archive, static-assets

[FAIL] CC6.1 - Service Account Key Rotation
       Evidence: 5 service account keys older than 90 days
       Keys: sa-prod@project.iam (183 days), sa-backup@project.iam (274 days)

HIGH - Address Soon:
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[FAIL] CC7.1 - Audit Logging
[FAIL] CC6.3 - Disk Encryption

Report saved to: gcp-soc2-report-2025-11-04.pdf

Breaking Changes

None. This is a purely additive release. All existing functionality for AWS and Azure remains unchanged.

Bug Fixes

• Fixed framework filtering for NIST 800-53 crosswalk mappings
• Improved error messages for missing cloud provider credentials
• Fixed nil pointer dereferences when API calls fail
• Corrected CMMC Level 1 control count (removed mislabeled Level 2 controls)

Known Limitations

Automated Checks Only

This tool scans technical infrastructure configurations. Full compliance certification requires:

• Documented policies and procedures
• Employee training and awareness programs
• Physical security controls
• Third-party risk assessments
• Business continuity planning
• Formal audits by qualified assessors (C3PAO for CMMC, QSA for PCI-DSS, etc.)

Not a Certification

High scan scores do not equal compliance certification. AuditKit helps you:

• Identify technical control gaps
• Prepare for formal assessments
• Track compliance progress over time
• Generate evidence for auditors

Use AuditKit as part of a comprehensive compliance program, not as a replacement for professional audits.

What's Not Included (Free Version)

The following features are available in AuditKit Pro:

• Multi-account/multi-project scanning (AWS Organizations, Azure Management Groups, GCP Folders)
• Enhanced SOC2 with 78 additional controls
• Advanced GKE and Vertex AI compliance checks
• Evidence package generation for audit-ready documentation
• Exception and waiver management
• Continuous monitoring daemon for ongoing compliance
• Multi-environment drift detection (dev vs prod consistency)

Interested in Pro features? Contact: info@auditkit.io

What's Next

Roadmap for upcoming releases:

v0.8.0 (Planned: December 2025)

• FedRAMP baseline filtering (Low/Moderate/High)
• Additional CIS coverage for Azure and GCP
• Enhanced multi-account orchestration
• Performance optimizations for large-scale scans

v0.9.0 (Planned: Q1 2026)

• Kubernetes compliance scanning (CIS Kubernetes Benchmarks)
• Container security scanning
• IaC compliance (Terraform, CloudFormation)

Getting Help

• Documentation: https://github.com/guardian-nexus/auditkit/tree/main/docs
• Issues: https://github.com/guardian-nexus/auditkit/issues
• Email: info@auditkit.io

Full Changelog

See CHANGELOG.md for complete details of all changes in this release.

AuditKit v0.7.0 - Multi-cloud compliance scanning for AWS, Azure, and GCP.

Release Date: October 13, 2025

What's New

NIST 800-53 Rev 5 Framework Crosswalk

AuditKit now supports NIST 800-53 Rev 5 scanning through an intelligent framework crosswalk system. Instead of building entirely new checks, we map your existing SOC2, PCI-DSS, and CMMC controls to NIST 800-53 control families.

Quick Example:

# Scan your AWS environment with 800-53 mapping
./auditkit scan -provider aws -framework 800-53

# See results with NIST control IDs
✓ Mapped CC6.6 → IA-2, IA-2(1), IA-5
✓ Mapped CC7.1 → AU-2, AU-3, AU-12
✓ Mapped CC6.1 → AC-2, AC-3, AC-17

[FAIL] IA-2, IA-2(1), IA-5 - Authentication Controls (via CC6.6)
[FAIL] AU-2, AU-3, AU-12 - Audit Logging (via CC7.1)
[FAIL] AC-2, AC-3, AC-17 - Access Controls (via CC6.1)

What You Get

Automated Technical Checks (~150 controls)

Control Families Covered:

• Access Control (AC): 12 automated checks
• Audit and Accountability (AU): 15 automated checks
• Identification and Authentication (IA): 18 automated checks
• System and Communications Protection (SC): 22 automated checks
• System and Information Integrity (SI): 14 automated checks
• Plus 14 more families: CA, CM, IR, MA, MP, PE, PL, PM, PS, RA, SA, SR (3-8 checks each)

Framework Crosswalk Mappings

The crosswalk intelligently maps:

• SOC2 → 800-53: CC6.6 (MFA) → IA-2, IA-2(1), IA-5
• PCI-DSS → 800-53: Requirement 8.3.1 (MFA) → IA-2(1), IA-5(1)
• CMMC → 800-53: AC.L1-3.1.1 → AC-2, AC-3

Report Generation

• PDF reports with 800-53 control IDs and evidence checklists
• HTML reports with interactive control navigation
• Shows source control so you know where the mapping came from

How It Works

1. Framework Crosswalk Engine

New pkg/mappings/crosswalk.go provides intelligent control mapping:

// Check if a control has 800-53 mappings
if crosswalk.ControlHas800_53(control.Frameworks, control.ID) {
    // Get the NIST 800-53 IDs
    nist80053IDs := crosswalk.Get800_53String(control.Frameworks, control.ID)
    // Result: "IA-2, IA-2(1), IA-5"
}

2. Dual Lookup Strategy

Primary: Uses your control's framework mappings

Frameworks: map[string]string{
    "SOC2": "CC6.6",
    "PCI":  "8.3.1",
}
// Crosswalk looks up: SOC2 CC6.6 → IA-2, IA-2(1), IA-5

Fallback: Uses control ID directly

Control: "CC6.6"
// Crosswalk looks up: CC6.6 → IA-2, IA-2(1), IA-5

This means all controls get mapped, even if they don't have explicit framework mappings!

3. Clean Output

Control IDs are cleaned and truncated for readability:

• Long IDs (>60 chars) truncated to prevent page overflow
• Unicode characters (→, •, —) converted to ASCII
• Source control shown in parentheses: "(via CC6.6)"

Important Limitations

What's NOT Included (FREE Version)

Organizational Controls (~850 controls)

• Policies and procedures
• Training records and documentation
• Risk assessments and management plans
• Business continuity and disaster recovery
• Physical security controls
• Third-party assessments

These require manual documentation and cannot be automated.

What's NOT Included (Any Version)

This is not:

• A complete NIST 800-53 certification tool
• A FedRAMP authorization package
• A replacement for security assessors
• A vulnerability scanner

This IS:

• An automated technical control checker
• A gap analysis tool for 800-53 readiness
• A mapping between SOC2/PCI/CMMC and 800-53
• A starting point for 800-53 compliance

Getting Started

Installation

# Clone and build
git clone https://github.com/guardian-nexus/auditkit
cd auditkit/scanner
go build ./cmd/auditkit

# Or download from releases
wget https://github.com/guardian-nexus/auditkit/releases/download/v0.6.8/auditkit-linux-amd64
chmod +x auditkit-linux-amd64

Basic Usage

# Run 800-53 scan
./auditkit scan -provider aws -framework 800-53

# Verbose output with mapping details
./auditkit scan -provider aws -framework 800-53 -verbose

# Generate PDF report
./auditkit scan -provider aws -framework 800-53 -format pdf -output report.pdf

# See all controls (no truncation)
./auditkit scan -provider aws -framework 800-53 --full

Azure Support

# Configure Azure credentials
az login
export AZURE_SUBSCRIPTION_ID="your-subscription-id"

# Run 800-53 scan on Azure
./auditkit scan -provider azure -framework 800-53

What's Changed

New Files

• pkg/mappings/crosswalk.go - Framework crosswalk engine
• pkg/mappings/framework-crosswalk.yaml - Control mappings database

Modified Files

• cmd/auditkit/main.go - Added 800-53 framework validation and filtering
• pkg/report/pdf.go - Added 800-53 report sections and control ID handling
• pkg/report/html.go - Added 800-53 framework label support

New Functions

• Get800_53ByControlID() - Direct control ID to 800-53 lookup
• Get800_53StringByControlID() - Formatted string output
• ControlHas800_53() - Check if control has 800-53 mapping
• Get800_53String() - Get comma-separated 800-53 IDs
• cleanString() - Unicode character cleanup for PDFs

Bug Fixes

• Fixed PDF generation errors with long control IDs (now truncated at 60 chars)
• Fixed unicode character handling in control names and evidence text
• Fixed framework detection for controls without explicit framework mappings
• Improved error handling when crosswalk YAML fails to load

Breaking Changes

None. This release is fully backward compatible. Existing scans (SOC2, PCI, CMMC, HIPAA) work exactly as before.

What's Next

Planned Features

• v0.7.0: Prowler integration for complete 1000+ control coverage
• v0.7.1: GCP provider support
• v0.8.0: FedRAMP baseline analysis (LOW/MODERATE/HIGH)
• v0.9.0: Kubernetes compliance scanning

Community Requests

See our roadmap for planned features and vote on what you'd like to see next.

What's Fixed

HTML Report URL Overflow

Long console URLs in evidence guides now wrap properly instead of breaking page layout.

Before:

• URLs extended beyond page boundaries
• Evidence guides were unreadable
• Console links broke layout

After:

• URLs wrap across multiple lines
• Evidence guides stay within container
• Console links truncate with ellipsis

README Improvements

• 60% shorter (1000 lines → 400 lines)
• Better organized sections
• No excessive emoji usage
• Added HTML/PDF report preview section

Upgrade

# Download binary
wget https://github.com/guardian-nexus/auditkit/releases/download/v0.6.7/auditkit-linux-amd64

# Or rebuild from source
git pull origin main
go build ./cmd/auditkit

v0.6.6 - Critical Hotfix + Examples

Critical Fixes

PCI-DSS Scanner Crash

• Fixed nil pointer dereference when AWS API calls fail
• Scanner now returns ERROR status instead of crashing
• Affects all PCI-DSS scans on v0.6.5 and earlier

Build Issues

• Removed duplicate min function causing compilation errors
• Stripped debug paths from binaries (security improvement)
• Binary size reduced ~30% (35MB → 24MB)

New Documentation

Examples Added

• Sample compliance reports (AWS/Azure SOC2, PCI-DSS, CMMC)
• Terminal output examples
• HTML and PDF report screenshots
• Real-world use cases documented

View examples: docs/examples/

Important

If using v0.6.5, upgrade immediately. That release contains the PCI-DSS crash bug and embedded build paths.

Installation

Linux (x64)

curl -LO https://github.com/guardian-nexus/auditkit/releases/download/v0.6.6/auditkit-v0.6.6-linux-amd64.tar.gz
tar -xzf auditkit-v0.6.6-linux-amd64.tar.gz
chmod +x auditkit-linux-amd64
./auditkit-linux-amd64 version

macOS (Apple Silicon)

curl -LO https://github.com/guardian-nexus/auditkit/releases/download/v0.6.6/auditkit-v0.6.6-darwin-arm64.tar.gz
tar -xzf auditkit-v0.6.6-darwin-arm64.tar.gz
chmod +x auditkit-darwin-arm64
./auditkit-darwin-arm64 version

Windows

Invoke-WebRequest -Uri "https://github.com/guardian-nexus/auditkit/releases/download/v0.6.6/auditkit-v0.6.6-windows-amd64.zip" -OutFile "auditkit.zip"
Expand-Archive -Path auditkit.zip -DestinationPath .
.\auditkit-windows-amd64.exe version

See CHANGELOG.md for complete version history.

Release Date: October 11, 2025

What's Fixed

Critical Bug Fix: PCI-DSS scans no longer crash when AWS credentials have limited EC2 permissions. The scanner now gracefully handles permission errors instead of panicking.

Technical Details

• Fixed nil pointer dereference in PCI Requirement 1.2.1 (Network Segmentation)
• Fixed nil pointer dereference in PCI Requirement 2.2.2 (Default Configurations)
• Improved error messages to indicate missing permissions
• Removed hardcoded development paths from source files

Who Should Update

Anyone running PCI-DSS scans with restricted AWS credentials.

Upgrade Instructions

Linux/macOS

curl -L https://github.com/guardian-nexus/auditkit/releases/download/v0.6.5/auditkit-linux-amd64.tar.gz -o auditkit
chmod +x auditkit
./auditkit --version

Windows (PowerShell)

Invoke-WebRequest -Uri "https://github.com/guardian-nexus/auditkit/releases/download/v0.6.5/auditkit-windows-amd64.exe" -OutFile "auditkit.exe"
.\auditkit.exe --version

Using Go

go install github.com/guardian-nexus/auditkit/scanner/cmd/auditkit@v0.6.5

Full Changelog

Changed:

• PCI scanner error handling improved

Fixed:

• PCI-DSS scanner panic on insufficient EC2 permissions
• Error handling in network segmentation checks

Full Changelog: guardian-nexus/AuditKit@v0.6.4...v0.6.5

Enhanced Compliance Reporting

Report Improvements:

• Added comprehensive compliance disclaimers to PDF and HTML reports
• Enhanced clarity on automated vs manual control requirements
• Improved CMMC Level 1 reporting with FCI-specific guidance
• Fixed HTML percentage display formatting in score circles
• Added framework-specific assessor requirements (C3PAO, QSA, etc.)

Technical Updates:

• Updated Azure scanner parameter ordering for CMMC Level 1 checks
• Improved report structure to distinguish automated checks from manual documentation
• Enhanced evidence collection guidance in all report formats

User Experience:

• Reports now clearly show:
  • Automated technical checks (infrastructure/configurations)
  • Manual documentation requirements (policies/procedures)
  • Formal assessment requirements by qualified auditors
• Better guidance on what constitutes full compliance vs automated check scores

Why This Matters

High automated check scores do not equal full compliance. This update helps users:

• Understand the scope of automated scanning
• Identify manual documentation gaps
• Prepare properly for formal assessments
• Avoid misinterpreting technical scores as compliance certifications

Fixed

• PDF Unicode rendering issues (bullets, checkmarks now display correctly)
• Spacing in passed controls section ([PASS] now has proper spacing)

Added

• Professional PDF cover page with circular compliance score
• Executive summary section in plain English
• Full HTML report generator with modern, responsive design
• Interactive tabs in HTML reports (Failed/Passed controls)
• Clickable Console URLs in HTML reports
• Copy-paste ready remediation commands in code blocks

Changed

• Improved evidence collection guide formatting
• Enhanced visual hierarchy in both PDF and HTML outputs

Technical

• Created new /pkg/report/html.go with 644 lines of clean HTML generation
• Refactored PDF generation functions to avoid naming conflicts
• Updated main.go HTML output to use new generator

Fixed

• Fixed CMMC showing 0/17 controls (now properly returns results)
• Fixed SOC2 showing 0/0 controls (framework filtering bug)
• Fixed PCI showing 0/0 controls (framework filtering bug)
• Fixed import path issues

This is a hotfix for v0.6.1

Added

• M365 Integration: New integrate command for importing ScubaGear M365 security results
• Community Contribution: Comprehensive Entra ID mappings (29 rules) contributed by community member
• Unified compliance reporting across AWS, Azure, and M365
• Step-by-step remediation guidance for M365 controls
• Screenshot evidence collection instructions for Entra ID policies
• Direct Azure portal console URLs for each control
• Framework mappings: M365 findings now map to SOC2, PCI-DSS, HIPAA

Changed

• Updated version to v0.6.1
• Improved error messages for integration failures
• Enhanced verbose mode for debugging integration parsing

Removed

• Telemetry tracking completely removed (no analytics or usage tracking)

Technical

• New integration framework at pkg/integrations/
• ScubaGear parser implementation
• Community-contributed mappings at mappings/scubagear/entra.json

Credits

Special thanks to our community contributor for the comprehensive Entra ID security mappings that make AuditKit the first open-source tool providing unified AWS, Azure, and M365 compliance reporting.

Added

CMMC Level 1 Support: Complete implementation of all 17 CMMC Level 1 practices for both AWS and Azure DoW Contractor Compliance: Support for Federal Contract Information (FCI) protection requirements November 10, 2025 Deadline Tracking: Built-in countdown and deadline warnings for CMMC compliance CMMC Evidence Collection: Screenshot guides and console URLs for all 17 Level 1 practices Framework-Specific Help: Enhanced verbose output with control counts and deadline information Upgrade Messaging: Clear path to CMMC Level 2 Pro for organizations handling CUI

Enhanced

Multi-Framework Support: CMMC now joins SOC2 and PCI-DSS as fully supported compliance frameworks Deadline Awareness: Time-sensitive compliance requirements now show days remaining Evidence Collection: Consistent screenshot guide format across all frameworks Framework Validation: Improved error handling and help text for supported frameworks

Technical

Added cmmc_level1.go for AWS provider with all 17 practices Added cmmc_level1.go for Azure provider with all 17 practices Enhanced main.go with CMMC-specific verbose output and deadline calculations Improved framework filtering logic to handle CMMC controls Added CMMC control name mappings and categorization

Business

Open Source Strategy: CMMC Level 1 freely available to build credibility with DoD contractors Clear Monetization Path: Level 2 Pro offering for organizations requiring CUI protection (110 practices) Market Timing: Release aligns with growing urgency around November 2025 deadline

Added

• Azure Support - Complete Azure provider implementation
  • Full SOC2 Common Criteria coverage (all 64 controls across CC1-CC9)
  • Full PCI-DSS v4.0 implementation (30 technical controls)
  • Storage Account security (public access, encryption, secure transfer)
  • Azure AD/Entra ID validation (MFA, privileged roles, guest access)
  • Network Security Group analysis (open ports, dangerous rules)
  • VM and Disk encryption checks
  • Key Vault security (purge protection, soft delete)
  • Activity Log retention validation (12-month for PCI-DSS)
  • Azure SQL security assessment (TDE, auditing)
  • Dedicated SOC2 modules (soc2_cc1_cc2.go, soc2_cc3_cc5.go, soc2_cc6_cc9.go)

Changed

• Improved Error Messages - Better guidance when credentials not configured
• Framework Consistency - Aligned control mappings between AWS and Azure
• Updated Dependencies - Added Azure SDK for Go

Fixed

• Azure SDK compatibility issues (method names, field access)
• Compilation errors in Azure check files
• Missing package declarations in some files
• Types.go emoji field removed completely

Technical

• Added /pkg/azure/ provider structure
• Implemented 10+ Azure check files (storage, aad, network, compute, etc.)
• Updated main.go to support multi-cloud providers
• Added Azure authentication support (CLI, Service Principal, Managed Identity)

Added

• Complete SOC2 Common Criteria implementation (64 controls across CC1-CC9)
• AWS connectivity check before scanning (prevents false results)
• Defensive nil checks for all AWS API responses

Fixed

• Critical: Nil pointer dereferences in SOC2 checks when AWS APIs fail
• AWS SDK v2 type mismatches (pointer vs value types)
• Scanner reporting fake pass/fail results when not connected to AWS
• Memory access violations in CC6.2, CC6.5, and CC3-CC5 checks

Changed

• Help text clarifies Azure/GCP "coming soon" status
• Help text marks PCI/HIPAA as "EXPERIMENTAL - limited controls"
• Improved error messages when AWS credentials not configured

Technical

• Fixed soc2_cc1_cc2.go, soc2_cc3_cc5.go, soc2_cc6_cc9.go
• Updated scanner.go to check AWS connectivity first
• Removed duplicate/conflicting SSM client initialization

Added

• Multi-framework support (SOC2, PCI-DSS, HIPAA)
• Framework-specific priority mapping
• Cross-framework control comparison
• Framework-aware evidence collection
• 64 complete SOC2 controls

Added

• Evidence collection tracker (auditkit evidence)
• Progress tracking over time (auditkit progress)
• Auto-generate remediation scripts (auditkit fix)
• Compare scans (auditkit compare)
• 25+ SOC2 controls (up from ~10)
• Enhanced PDF reports with screenshot guides
• Success celebration at 90%+ compliance