FDA-NTIA-006 warning

Author of the SBOM data is present

Pack fda-524b 1.0.0

Severity: warning
An NTIA baseline attribute. The guidance frames these as 'should', and in practice a missing baseline attribute returns as a review deficiency or an eSTAR technical screening hold rather than a refusal, so it costs weeks rather than the filing.
Applies to: cyclonedx, spdx
Selector: {"cyclonedx":"$.metadata","spdx":"$.creationInfo"}
On an empty selector: fire
The selector names a specific object the assertion inspects. When that object is absent the information the rule exists to check was not supplied at all, which is a stronger failure than supplying it badly. Reporting nothing would make a missing section indistinguishable from a satisfied one.
Fix: Name the entity that generated the SBOM.
Source: ntia-2021: Minimum elements, baseline attributes table
Note: NTIA 2021 BASELINE, not CISA 2026. FDA has not adopted the 2026 element set. SPDX carries creators as strings of the form 'Organization: X' or 'Tool: y-1.0', not as objects. The acronym and version checks in the CycloneDX branch are applied to the parsed suffix by the engine, not by this assert.

Check a file against this

npx stratifypro check sbom.json --pack fda-524b
npx stratifypro explain FDA-NTIA-006 --pack fda-524b prints this page.