FDA-NTIA-001 warning

Supplier name is present for every component

Pack fda-524b 1.0.0

Severity: warning
An NTIA baseline attribute. The guidance frames these as 'should', and in practice a missing baseline attribute returns as a review deficiency or an eSTAR technical screening hold rather than a refusal, so it costs weeks rather than the filing.
Applies to: cyclonedx, spdx
Selector: {"cyclonedx":"$.components[*]","spdx":"$.packages[*]"}
On an empty selector: fire
The selector walks a collection and the assertion asks whether each member carries something. A document with zero members has not satisfied that requirement, it has avoided being measured against it, and reporting nothing would let an empty or absent collection read as a clean result. The absence is the violation.
Fix: Name the supplier of each component. Measured across 10,000 repositories, zero percent of generated SBOMs carry this, so expect to add it by hand or fix your generator.
Source: ntia-2021: Minimum elements, baseline attributes table
Note: NTIA 2021 BASELINE, not CISA 2026. FDA has not adopted the 2026 element set.

Check a file against this

npx stratifypro check sbom.json --pack fda-524b
npx stratifypro explain FDA-NTIA-001 --pack fda-524b prints this page.