CISA-PR-005 info

Frequency: the document is bound to a specific component version

Pack cisa-2026-v2.1 1.0.0

Severity: info
Each software version should have its own SBOM. A file-level proxy is whether the document names the exact component version it describes, so a consumer can tell which build it belongs to.
Applies to: cyclonedx, spdx
Selector: {"cyclonedx":"$.metadata.component","spdx":"$.packages[0]"}
On an empty selector: fire
The selector names a specific object the assertion inspects. When that object is absent the information the rule exists to check was not supplied at all, which is a stronger failure than supplying it badly. Reporting nothing would make a missing section indistinguishable from a satisfied one.
Fix: Generate a new SBOM for every build or release, and reissue a revised one when you discover new details or correct an error.
Source: cisa-2026-v2.1: Practices and Processes, 5, Frequency (Minor Update)
Note: PARTIAL CHECK. Whether the author actually reissues on every build cannot be seen from one file.

Check a file against this

npx stratifypro check sbom.json --pack cisa-2026-v2.1
npx stratifypro explain CISA-PR-005 --pack cisa-2026-v2.1 prints this page.