CISA-MD-008 info

SBOM Tool Version is present, or explicitly unknown

Pack cisa-2026-v2.1 1.0.0

Severity: info
The document is unusually precise here: an empty value is non-conformant but an explicit 'unknown' is conformant. This rule enforces that distinction rather than treating silence and 'unknown' as the same.
Applies to: cyclonedx, spdx
Selector: {"cyclonedx":"$.metadata.tools[*]","spdx":"$.creationInfo"}
On an empty selector: fire
The selector walks a collection and the assertion asks whether each member carries something. A document with zero members has not satisfied that requirement, it has avoided being measured against it, and reporting nothing would let an empty or absent collection read as a clean result. The absence is the violation.
Fix: Record the tool version. If no version identifier is available, state 'unknown' explicitly rather than leaving the field empty.
Source: cisa-2026-v2.1: SBOM Metadata, element 8, SBOM Tool Version (New)
Note: Empty is non-conformant, explicit 'unknown' is conformant. This is the Explicitly Identifying Unknown Information practice applied at field level. SPDX carries creators as strings of the form 'Organization: X' or 'Tool: y-1.0', not as objects. The acronym and version checks in the CycloneDX branch are applied to the parsed suffix by the engine, not by this assert.

Check a file against this

npx stratifypro check sbom.json --pack cisa-2026-v2.1
npx stratifypro explain CISA-MD-008 --pack cisa-2026-v2.1 prints this page.