CISA-PR-002 warning

Coverage: transitive dependencies are present, or incompleteness is declared

Pack cisa-2026-v2.1 1.0.0

Severity: warning
The 2026 update extended Coverage to transitive dependencies explicitly. The document's own test is that a recipient should be able to conclude a new vulnerability does not affect them if the component is absent from the SBOM. A flat top-level-only list makes that conclusion unsafe while looking complete.
Applies to: cyclonedx, spdx
Selector: {"cyclonedx":"$","spdx":"$"}
On an empty selector: fire
The selector is the document root, which is present in every parsed document, so this rule can never see an empty selector. The value is declared because the field is required of every rule, and fire is the conservative choice should a future selector change make it reachable.
Fix: Include transitive dependencies. There is no minimum depth, but if the graph is shallow or partial, declare that explicitly so a reader does not mistake absence of data for absence of risk.
Source: cisa-2026-v2.1: Practices and Processes, 2, Coverage (Major Update)
Note: CHANGE FROM 2021: transitive dependencies are now named explicitly. Also: multiple instances of a component with differing metadata should each be listed separately with their own dependency relationship.

Check a file against this

npx stratifypro check sbom.json --pack cisa-2026-v2.1
npx stratifypro explain CISA-PR-002 --pack cisa-2026-v2.1 prints this page.