CISA-CD-001 warning

Component Producer is present, singular, and not a bare acronym

Pack cisa-2026-v2.1 1.0.0

Severity: warning
This element replaces Supplier Name and exists to give a point of contact for security concerns and to disambiguate same-named components from different producers. Measurement across 10,000 repositories found zero percent of generated SBOMs carry it, so this rule will fire on almost every real file, which is the point.
Applies to: cyclonedx, spdx
Selector: {"cyclonedx":"$.components[*]","spdx":"$.packages[*]"}
On an empty selector: fire
The selector walks a collection and the assertion asks whether each member carries something. A document with zero members has not satisfied that requirement, it has avoided being measured against it, and reporting nothing would let an empty or absent collection read as a clean result. The absence is the violation.
Fix: Name the entity that created the component. Exactly one. For open source, use the package manager's convention where one exists, otherwise the original project or maintaining organization. If there is genuinely no clear producer, state unknown provenance explicitly.
Source: cisa-2026-v2.1: Component Data, element 1, Component Producer (Major Update)
Note: RENAME: this element replaces 'Supplier Name' from the 2021 NTIA elements. A rule pack built to the 2021 baseline uses the old name and is out of date. Footnote 10 warns that 'producer' is not the EU term of art 'manufacturer': all manufacturers are producers, not all producers are manufacturers.

Check a file against this

npx stratifypro check sbom.json --pack cisa-2026-v2.1
npx stratifypro explain CISA-CD-001 --pack cisa-2026-v2.1 prints this page.