All rules

CISA-MD-003 info

SBOM Data Format Name is declared

Pack cisa-2026-v2.1 1.0.0

Severity
info
Both formats carry this structurally, so this rule almost never fires on a real file. It exists so a hand-assembled or converted document that lost its format marker is caught rather than silently misread.
Applies to
cyclonedx, spdx
Selector
{"cyclonedx":"$","spdx":"$"}
On an empty selector
fire
The selector is the document root, which is present in every parsed document, so this rule can never see an empty selector. The value is declared because the field is required of every rule, and fire is the conservative choice should a future selector change make it reachable.
Fix
Emit the document through a conformant serializer rather than hand-editing it.
Source
cisa-2026-v2.1: SBOM Metadata, element 3, SBOM Data Format Name (New)

Check a file against this

npx stratifypro check sbom.json --pack cisa-2026-v2.1
npx stratifypro explain CISA-MD-003 --pack cisa-2026-v2.1 prints this page.

This rule and its justification come from the source named above. No regulator has reviewed this tool, and a rule passing does not mean a submission will be accepted.