CISA-CD-005 warning

Every component carries at least one machine-readable identifier

Pack cisa-2026-v2.1 1.0.0

Severity: warning
This is the element the whole matching layer depends on. Without an identifier a component cannot be looked up in any vulnerability database, which is precisely the failure that produces an FDA information request. Escalated to error in the FDA pack, where a named downstream consequence justifies it.
Applies to: cyclonedx, spdx
Selector: {"cyclonedx":"$.components[*]","spdx":"$.packages[*]"}
On an empty selector: fire
The selector walks a collection and the assertion asks whether each member carries something. A document with zero members has not satisfied that requirement, it has avoided being measured against it, and reporting nothing would let an empty or absent collection read as a clean result. The absence is the violation.
Fix: Add at least one identifier, preferably a Package URL. Include every identifier you have, not just one: the document says if there are multiple, include all of them.
Source: cisa-2026-v2.1: Component Data, element 5, Component Identifiers (Major Update)
Note: PURL is now Ecma International ECMA-427, December 2025. Cite the Ecma standard, not just the GitHub specification. Prefer PURL over CPE: since NIST's 15 April 2026 change, most new CVEs never receive a CPE at all.

Check a file against this

npx stratifypro check sbom.json --pack cisa-2026-v2.1
npx stratifypro explain CISA-CD-005 --pack cisa-2026-v2.1 prints this page.