CISA-PR-004 warning

Explicitly identifying unknown information: gaps are stated, not silent

Pack cisa-2026-v2.1 1.0.0

Severity: warning
The highest-leverage practice in the document and the one most often ignored. The distinction it draws is between information unknown to the author and information the author is withholding, and a reader is entitled to know which. A field left empty tells them neither.
Applies to: cyclonedx, spdx
Selector: {"cyclonedx":"$","spdx":"$"}
On an empty selector: fire
The selector is the document root, which is present in every parsed document, so this rule can never see an empty selector. The value is declared because the field is required of every rule, and fire is the conservative choice should a future selector change make it reachable.
Fix: Where a field is not provided, state whether the information is unknown to you or withheld by you. Have a process for recipients to ask about redacted security-related information.
Source: cisa-2026-v2.1: Practices and Processes, 4, Explicitly Identifying Unknown Information (Major Update)
Note: The document warns that organizations may consider an SBOM incomplete if the author withholds essential component data. Measured baseline: only 0.10 percent of CycloneDX SBOMs use compositions at all. This rule previously carried a second arm, matchesAny NOASSERTION, evaluated as a substring search across the whole serialised document. That arm was removed on 20 September 2026. It made the rule pass on 12 of the 13 SPDX corpus files, up to 4,140 occurrences in one, because syft and tern emit NOASSERTION automatically into empty licence and supplier fields. A token a generator writes by default is not an author deliberately identifying unknown information, and treating it as one put the rule in direct contradiction with the published finding that 0 of 21 corpus files admit incompleteness. With the arm removed the rule fires on all 21, which reproduces that published figure exactly. Neither fixture exercised the removed arm, so both continue to behave as before.

Check a file against this

npx stratifypro check sbom.json --pack cisa-2026-v2.1
npx stratifypro explain CISA-PR-004 --pack cisa-2026-v2.1 prints this page.