CISA-MD-006 warning

SBOM Timestamp is present and is a valid RFC 9557 timestamp

Pack cisa-2026-v2.1 1.0.0

Severity: warning
A document with no timestamp cannot be ordered against any other version of itself, which defeats the Frequency practice entirely. Flagged separately because the required format is RFC 9557, not RFC 3339.
Applies to: cyclonedx, spdx
Selector: {"cyclonedx":"$.metadata","spdx":"$.creationInfo"}
On an empty selector: fire
The selector names a specific object the assertion inspects. When that object is absent the information the rule exists to check was not supplied at all, which is a stronger failure than supplying it badly. Reporting nothing would make a missing section indistinguishable from a satisfied one.
Fix: Emit the timestamp of the most recent update to the SBOM data in RFC 9557 format.
Source: cisa-2026-v2.1: SBOM Metadata, element 6, SBOM Timestamp (Minor Update)
Note: IMPLEMENTER WARNING: RFC 9557 is RFC 3339 plus optional bracketed suffixes such as [America/New_York]. A validator that accepts only RFC 3339 will reject conformant timestamps. The regex above accepts both.

Check a file against this

npx stratifypro check sbom.json --pack cisa-2026-v2.1
npx stratifypro explain CISA-MD-006 --pack cisa-2026-v2.1 prints this page.