CISA-PR-001 info

Accommodation of updates: the document is revisable and identifies its own version

Pack cisa-2026-v2.1 1.0.0

Severity: info
A practice, not a data field, so it is only partly checkable from a file. What a file can show is whether it is versioned well enough for a correction to be issued against it.
Applies to: cyclonedx, spdx
Selector: {"cyclonedx":"$","spdx":"$"}
On an empty selector: fire
The selector is the document root, which is present in every parsed document, so this rule can never see an empty selector. The value is declared because the field is required of every rule, and fire is the conservative choice should a future selector change make it reachable.
Fix: Version the SBOM so corrections can be issued and recognised. Correct errors promptly when found.
Source: cisa-2026-v2.1: Practices and Processes, 1, Accommodation of Updates to SBOM Data (Major Update)
Note: PARTIAL CHECK. The organizational half of this practice cannot be checked from a file and must be asserted by the author.

Check a file against this

npx stratifypro check sbom.json --pack cisa-2026-v2.1
npx stratifypro explain CISA-PR-001 --pack cisa-2026-v2.1 prints this page.