CISA-PR-006 warning

Machine-processable data: the document parses as a current, non-deprecated format

Pack cisa-2026-v2.1 1.0.0

Severity: warning
The whole point of the exercise. A document that cannot be parsed by a standard tool provides no automation value regardless of what it contains.
Applies to: cyclonedx, spdx
Selector: {"cyclonedx":"$","spdx":"$"}
On an empty selector: fire
The selector is the document root, which is present in every parsed document, so this rule can never see an empty selector. The value is declared because the field is required of every rule, and fire is the conservative choice should a future selector change make it reachable.
Fix: Publish in SPDX or CycloneDX. Avoid deprecated versions of either format for new software.
Source: cisa-2026-v2.1: Practices and Processes, 6, Machine-Processable Data (Major Update)
Note: Standards references from the document: SPDX is ISO/IEC 5962:2021. CycloneDX is Ecma International ECMA-424, December 2025. Both should be cited as standards, not only as project websites.

Check a file against this

npx stratifypro check sbom.json --pack cisa-2026-v2.1
npx stratifypro explain CISA-PR-006 --pack cisa-2026-v2.1 prints this page.