CISA-CD-006 info

Component License is present, or explicitly unknown

Pack cisa-2026-v2.1 1.0.0

Severity: info
Measured license accuracy in generated SBOMs runs between 1.7 and 27.6 percent depending on tool and ecosystem, and components without an exact version carry no license data at all. The realistic ask is an explicit unknown rather than silence.
Applies to: cyclonedx, spdx
Selector: {"cyclonedx":"$.components[*]","spdx":"$.packages[*]"}
On an empty selector: fire
The selector walks a collection and the assertion asks whether each member carries something. A document with zero members has not satisfied that requirement, it has avoided being measured against it, and reporting nothing would let an empty or absent collection read as a clean result. The absence is the violation.
Fix: Use an SPDX license identifier where one applies. If no identifier fits, give a URL to the full license text. Flag proprietary conditions explicitly. If you do not know, say unknown.
Source: cisa-2026-v2.1: Component Data, element 6, Component License (New)
Note: The body definition and the Appendix A table definition differ slightly in wording: the body uses 'identifier(s)/license(s)', the table drops the parentheticals. Semantically identical.

Check a file against this

npx stratifypro check sbom.json --pack cisa-2026-v2.1
npx stratifypro explain CISA-CD-006 --pack cisa-2026-v2.1 prints this page.