Rules

Every rule carries a written justification for its severity and names the clause it comes from. A rule whose severity rests on nothing is the error this project was built to avoid repeating.

FDA section 524B premarket submission profile fda-524b 1.0.0

Rule	Severity	Source
FDA-STAT-001 A software bill of materials exists and is machine-readable	error	fdc-524b: Section 524B(b)(3), 21 USC 360n-2(b)(3)
FDA-STAT-002 The SBOM enumerates commercial, open-source and off-the-shelf components	error	fdc-524b: Section 524B(b)(3), 21 USC 360n-2(b)(3)
FDA-NTIA-001 Supplier name is present for every component	warning	ntia-2021: Minimum elements, baseline attributes table
FDA-NTIA-002 Component name is present	warning	ntia-2021: Minimum elements, baseline attributes table
FDA-NTIA-003 Version of the component is present	warning	ntia-2021: Minimum elements, baseline attributes table
FDA-NTIA-004 Other unique identifiers are present	warning	ntia-2021: Minimum elements, baseline attributes table
FDA-NTIA-005 Dependency relationships are declared	warning	ntia-2021: Minimum elements, baseline attributes table
FDA-NTIA-006 Author of the SBOM data is present	warning	ntia-2021: Minimum elements, baseline attributes table
FDA-NTIA-007 Timestamp is present	warning	ntia-2021: Minimum elements, baseline attributes table
FDA-SUP-001 Every component declares a software level of support	warning	fda-premarket-2026-02: Section V.A.4(b), first additional element
FDA-SUP-002 Every component declares an end-of-support date	warning	fda-premarket-2026-02: Section V.A.4(b), second additional element
FDA-VULN-001 Known vulnerabilities are identified, including CISA KEV entries	warning	fda-premarket-2026-02: Section V.A.4(b), known vulnerabilities paragraph
FDA-DEPTH-001 Transitive dependencies are present	warning	fda-premarket-2026-02: Section V.A.4, robust SBOM paragraph, and depth discussion
FDA-JUST-001 If SBOM information is missing, a justification is present	warning	fda-premarket-2026-02: Section V.A.4(b): 'If a manufacturer is unable to provide the SBOM information to FDA, the manufacturer should provide a justification'
FDA-USER-001 The SBOM is in a form that can be provided to users continuously	info	fda-premarket-2026-02: Section VI.A, labelling
FDA-TRACE-001 The SBOM can be traced to the threat model and risk assessment	info	fda-premarket-2026-02: Sections V.A and V.B.2, traceability

CISA 2026 Minimum Elements for a Software Bill of Materials, v2.1 cisa-2026-v2.1 1.0.0

Rule	Severity	Source
CISA-MD-001 SBOM Author is present and is not a bare acronym	warning	cisa-2026-v2.1: SBOM Metadata, element 1, SBOM Author (Major Update)
CISA-MD-002 SBOM Author Signature is present	warning	cisa-2026-v2.1: SBOM Metadata, element 2, SBOM Author Signature (New)
CISA-MD-003 SBOM Data Format Name is declared	info	cisa-2026-v2.1: SBOM Metadata, element 3, SBOM Data Format Name (New)
CISA-MD-004 SBOM Data Format Version is declared and not deprecated	warning	cisa-2026-v2.1: SBOM Metadata, element 4, SBOM Data Format Version (New)
CISA-MD-005 SBOM Generation Context is declared	warning	cisa-2026-v2.1: SBOM Metadata, element 5, SBOM Generation Context (New)
CISA-MD-006 SBOM Timestamp is present and is a valid RFC 9557 timestamp	warning	cisa-2026-v2.1: SBOM Metadata, element 6, SBOM Timestamp (Minor Update)
CISA-MD-007 SBOM Tool Name is present and is not a bare acronym	info	cisa-2026-v2.1: SBOM Metadata, element 7, SBOM Tool Name (New)
CISA-MD-008 SBOM Tool Version is present, or explicitly unknown	info	cisa-2026-v2.1: SBOM Metadata, element 8, SBOM Tool Version (New)
CISA-MD-009 SBOM Version is present, and SemVer major is 1 if SemVer is used	info	cisa-2026-v2.1: SBOM Metadata, element 9, SBOM Version (New)
CISA-CD-001 Component Producer is present, singular, and not a bare acronym	warning	cisa-2026-v2.1: Component Data, element 1, Component Producer (Major Update)
CISA-CD-002 Dependency relationships are declared	warning	cisa-2026-v2.1: Component Data, element 2, Component Dependency Relationship (Minor Update)
CISA-CD-003 Component Hash Value is present, or explicitly unknown	warning	cisa-2026-v2.1: Component Data, element 3, Component Hash Value (New)
CISA-CD-004 Component Hash Algorithm is a registered IANA Hash Function Textual Name	warning	cisa-2026-v2.1: Component Data, element 4, Component Hash Algorithm (New)
CISA-CD-005 Every component carries at least one machine-readable identifier	warning	cisa-2026-v2.1: Component Data, element 5, Component Identifiers (Major Update)
CISA-CD-006 Component License is present, or explicitly unknown	info	cisa-2026-v2.1: Component Data, element 6, Component License (New)
CISA-CD-007 Component Name is present and is not a bare acronym	warning	cisa-2026-v2.1: Component Data, element 7, Component Name (Minor Update)
CISA-CD-008 Component Version is present, or explicitly unknown	warning	cisa-2026-v2.1: Component Data, element 8, Component Version (Major Update)
CISA-PR-001 Accommodation of updates: the document is revisable and identifies its own version	info	cisa-2026-v2.1: Practices and Processes, 1, Accommodation of Updates to SBOM Data (Major Update)
CISA-PR-002 Coverage: transitive dependencies are present, or incompleteness is declared	warning	cisa-2026-v2.1: Practices and Processes, 2, Coverage (Major Update)
CISA-PR-003 Distribution and delivery: the document is retrievable at a stable reference	info	cisa-2026-v2.1: Practices and Processes, 3, Distribution and Delivery (Minor Update)
CISA-PR-004 Explicitly identifying unknown information: gaps are stated, not silent	warning	cisa-2026-v2.1: Practices and Processes, 4, Explicitly Identifying Unknown Information (Major Update)
CISA-PR-005 Frequency: the document is bound to a specific component version	info	cisa-2026-v2.1: Practices and Processes, 5, Frequency (Minor Update)
CISA-PR-006 Machine-processable data: the document parses as a current, non-deprecated format	warning	cisa-2026-v2.1: Practices and Processes, 6, Machine-Processable Data (Major Update)