CISA-MD-002 warning

SBOM Author Signature is present

Pack cisa-2026-v2.1 1.0.0

Severity: warning
New in 2026 and the element StratifyPro's evidence layer attaches to. Absence does not make a document wrong, but it makes tamper-evidence impossible, so a consumer has no way to know the file is as the author left it.
Applies to: cyclonedx, spdx
Selector: {"cyclonedx":"$","spdx":"$"}
On an empty selector: fire
The selector is the document root, which is present in every parsed document, so this rule can never see an empty selector. The value is declared because the field is required of every rule, and fire is the conservative choice should a future selector change make it reachable.
Fix: Sign the document with an algorithm approved by a relevant authority, for example one from the NIST Digital Signature Standard, ISO/IEC 14888-4:2024, or the ENISA Agreed Cryptographic Mechanisms list.
Source: cisa-2026-v2.1: SBOM Metadata, element 2, SBOM Author Signature (New)
Note: The document names DSS, ISO/IEC 14888-4:2024 and the ENISA list as examples of approved sources. It does not mandate a specific algorithm. SPDX 2.x has no native document signature field, so this rule will fire on essentially every SPDX 2.x file. That is a true finding about the format, not about the author, and the fix text says so.

Check a file against this

npx stratifypro check sbom.json --pack cisa-2026-v2.1
npx stratifypro explain CISA-MD-002 --pack cisa-2026-v2.1 prints this page.