CISA-MD-007 info

SBOM Tool Name is present and is not a bare acronym

Pack cisa-2026-v2.1 1.0.0

Severity: info
Tool identity is how a consumer weighs a known extractor defect. Informational because the consequence is a slightly weaker judgement, not a wrong one.
Applies to: cyclonedx, spdx
Selector: {"cyclonedx":"$.metadata.tools[*]","spdx":"$.creationInfo"}
On an empty selector: fire
The selector walks a collection and the assertion asks whether each member carries something. A document with zero members has not satisfied that requirement, it has avoided being measured against it, and reporting nothing would let an empty or absent collection read as a clean result. The absence is the violation.
Fix: Record the tool's full name. Acronyms are acceptable only when the tool's official name contains one.
Source: cisa-2026-v2.1: SBOM Metadata, element 7, SBOM Tool Name (New)
Note: SPDX carries creators as strings of the form 'Organization: X' or 'Tool: y-1.0', not as objects. The acronym and version checks in the CycloneDX branch are applied to the parsed suffix by the engine, not by this assert.

Check a file against this

npx stratifypro check sbom.json --pack cisa-2026-v2.1
npx stratifypro explain CISA-MD-007 --pack cisa-2026-v2.1 prints this page.