CISA-MD-009 info

SBOM Version is present, and SemVer major is 1 if SemVer is used

Pack cisa-2026-v2.1 1.0.0

Severity: info
The document states that a published SBOM following these minimum elements should carry SemVer major version 1. That makes the major version a directly checkable claim of conformance intent, which is rare and worth checking.
Applies to: cyclonedx, spdx
Selector: {"cyclonedx":"$","spdx":"$"}
On an empty selector: fire
The selector is the document root, which is present in every parsed document, so this rule can never see an empty selector. The value is declared because the field is required of every rule, and fire is the conservative choice should a future selector change make it reachable.
Fix: Set a version for this SBOM. If using Semantic Versioning, the major version should be 1. If using a serial number, conform to RFC 9562 for unique identifiers.
Source: cisa-2026-v2.1: SBOM Metadata, element 9, SBOM Version (New)
Note: Footnote 8 gives the sequence: next minor is 1.1, next major is 2. Footnote 9 cites RFC 9562 for UUID-style identifiers.

Check a file against this

npx stratifypro check sbom.json --pack cisa-2026-v2.1
npx stratifypro explain CISA-MD-009 --pack cisa-2026-v2.1 prints this page.