CISA-PR-003 info

Distribution and delivery: the document is retrievable at a stable reference

Pack cisa-2026-v2.1 1.0.0

Severity: info
Mostly an organizational practice. The file-level signal is whether it carries a version-specific reference a recipient could return to.
Applies to: cyclonedx, spdx
Selector: {"cyclonedx":"$.metadata.component","spdx":"$"}
On an empty selector: fire
The selector names a specific object the assertion inspects. When that object is absent the information the rule exists to check was not supplied at all, which is a stronger failure than supplying it badly. Reporting nothing would make a missing section indistinguishable from a satisfied one.
Fix: Make the SBOM available promptly to those who need it, through a version-specific URL, an API, or alongside installation. Access controls may limit who sees it but should not block authorized parties or prevent integration into trusted security tools.
Source: cisa-2026-v2.1: Practices and Processes, 3, Distribution and Delivery (Minor Update)
Note: PARTIAL CHECK. Note the 2026 document removed the separate Access Control element and folded it into this practice.

Check a file against this

npx stratifypro check sbom.json --pack cisa-2026-v2.1
npx stratifypro explain CISA-PR-003 --pack cisa-2026-v2.1 prints this page.