CISA-CD-007 warning

Component Name is present and is not a bare acronym

Pack cisa-2026-v2.1 1.0.0

Severity: warning
The human-readable handle for everything else. Distinct from the identifier, and the 2026 update explicitly allows multiple entries so alternate names can be captured, which is directly useful to identity resolution.
Applies to: cyclonedx, spdx
Selector: {"cyclonedx":"$.components[*]","spdx":"$.packages[*]"}
On an empty selector: fire
The selector walks a collection and the assertion asks whether each member carries something. A document with zero members has not satisfied that requirement, it has avoided being measured against it, and reporting nothing would let an empty or absent collection read as a clean result. The absence is the violation.
Fix: Use the full name the component producer assigned. Record alternate names as additional entries where the format allows.
Source: cisa-2026-v2.1: Component Data, element 7, Component Name (Minor Update)

Check a file against this

npx stratifypro check sbom.json --pack cisa-2026-v2.1
npx stratifypro explain CISA-CD-007 --pack cisa-2026-v2.1 prints this page.