FDA-NTIA-005 warning

Dependency relationships are declared

Pack fda-524b 1.0.0

Severity: warning
An NTIA baseline attribute. The guidance frames these as 'should', and in practice a missing baseline attribute returns as a review deficiency or an eSTAR technical screening hold rather than a refusal, so it costs weeks rather than the filing.
Applies to: cyclonedx, spdx
Selector: {"cyclonedx":"$","spdx":"$"}
On an empty selector: fire
The selector is the document root, which is present in every parsed document, so this rule can never see an empty selector. The value is declared because the field is required of every rule, and fire is the conservative choice should a future selector change make it reachable.
Fix: Emit the dependency graph. If it is incomplete, declare that explicitly rather than leaving it silent.
Source: ntia-2021: Minimum elements, baseline attributes table
Note: NTIA 2021 BASELINE, not CISA 2026. FDA has not adopted the 2026 element set.

Check a file against this

npx stratifypro check sbom.json --pack fda-524b
npx stratifypro explain FDA-NTIA-005 --pack fda-524b prints this page.