CISA-MD-001 warning

SBOM Author is present and is not a bare acronym

Pack cisa-2026-v2.1 1.0.0

Severity: warning
A consumer who cannot tell who generated the SBOM cannot weigh how much to trust it. The document asks for full names and explicitly distinguishes the author from the component producer. Warning rather than error because the source uses 'should' and carries no tiering.
Applies to: cyclonedx, spdx
Selector: {"cyclonedx":"$.metadata.authors[*]","spdx":"$.creationInfo"}
On an empty selector: fire
The selector walks a collection and the assertion asks whether each member carries something. A document with zero members has not satisfied that requirement, it has avoided being measured against it, and reporting nothing would let an empty or absent collection read as a clean result. The absence is the violation.
Fix: Record the full legal name of the entity that operated the tool. Acronyms are acceptable only when the entity's official name contains one.
Source: cisa-2026-v2.1: SBOM Metadata, element 1, SBOM Author (Major Update)
Note: The document is explicit that this captures the entity operating the tool, not the tool itself. See CISA-MD-007 for the tool. SPDX carries creators as strings of the form 'Organization: X' or 'Tool: y-1.0', not as objects. The acronym and version checks in the CycloneDX branch are applied to the parsed suffix by the engine, not by this assert.

Check a file against this

npx stratifypro check sbom.json --pack cisa-2026-v2.1
npx stratifypro explain CISA-MD-001 --pack cisa-2026-v2.1 prints this page.