AuditKit

Multi-framework compliance scanner that shows exactly what auditors need

✓ SOC2 Ready ⚡ PCI-DSS Beta ⚡ HIPAA Beta 🚧 ISO 27001 🚧 Azure/GCP
$ auditkit scan -framework all
# Scanning AWS account 123456789...

✗ CRITICAL: Root account missing MFA
→ SOC2: CC6.6 | PCI: 8.3.1 | HIPAA: §164.312(a)(2)(i)

✗ CRITICAL: S3 bucket 'customer-data' public
→ SOC2: CC6.3 | PCI: 1.3.1 | HIPAA: §164.312(a)(1)

$ auditkit evidence -framework soc2
Generating evidence checklist...
📸 23 screenshots needed | ✅ 5 collected | ⏳ 18 remaining

The Problem

Every compliance framework checks the same things with different names. You run separate tools for each one. Your auditor wants screenshots proving you fixed everything. But which screens? What format? What labels?

You hire consultants for $50K. They run the same scans and take the same screenshots you could have taken yourself—if you knew what auditors actually wanted to see.

One Scan, All Frameworks

What They Check SOC2 PCI-DSS HIPAA
MFA enabled? CC6.6 Req 8.3 §164.312(a)(2)(i)
Encryption at rest? CC6.3 Req 3.4 §164.312(a)(2)(iv)
Audit logging? CC7.1 Req 10.1 §164.312(b)
Access controls? CC6.1 Req 7.1 §164.312(a)(1)

AuditKit runs once, maps findings to all frameworks. No more juggling different scanners.

Reality Check: AuditKit won't pass your audit for you. SOC2 needs a CPA. PCI needs a QSA. But it will save you ~150 hours at $300/hour by showing exactly what evidence to collect.

What AuditKit Actually Does

64
SOC2 Controls
221+
Reddit Upvotes
4
Frameworks
$0
Cost Forever

Installation

# Quick install (Go required)
go install github.com/guardian-nexus/auditkit/scanner/cmd/auditkit@latest

# Or build from source
git clone https://github.com/guardian-nexus/auditkit.git
cd auditkit/scanner && go build ./cmd/auditkit

# Run your first scan
./auditkit scan -framework soc2 -format pdf -output evidence.pdf
Privacy: AuditKit runs entirely on your machine. No data leaves your infrastructure. No telemetry from the tool, no phone-home, no BS. Check the source code.

Who Should Use This

Who Should NOT Use This

View on GitHub Download Binary Get Updates

Current Status

v0.4.1 - Full SOC2 (64 controls), experimental PCI/HIPAA mapping, AWS provider complete.

Coming in v0.5.0 - Azure provider, complete PCI-DSS requirements, ScubaGear integration for M365.

On the roadmap - GCP provider, ISO 27001, NIST 800-53, automated evidence collection.