FDA-NTIA-004 warning

Other unique identifiers are present

Pack fda-524b 1.0.0

Severity: warning
An NTIA baseline attribute. The guidance frames these as 'should', and in practice a missing baseline attribute returns as a review deficiency or an eSTAR technical screening hold rather than a refusal, so it costs weeks rather than the filing.
Applies to: cyclonedx, spdx
Selector: {"cyclonedx":"$.components[*]","spdx":"$.packages[*]"}
On an empty selector: fire
The selector walks a collection and the assertion asks whether each member carries something. A document with zero members has not satisfied that requirement, it has avoided being measured against it, and reporting nothing would let an empty or absent collection read as a clean result. The absence is the violation.
Fix: Add a Package URL to every component. This is the single highest-value fix in the file.
Source: ntia-2021: Minimum elements, baseline attributes table
Note: NTIA 2021 BASELINE, not CISA 2026. FDA has not adopted the 2026 element set.

Check a file against this

npx stratifypro check sbom.json --pack fda-524b
npx stratifypro explain FDA-NTIA-004 --pack fda-524b prints this page.