FDA-NTIA-007 warning

Timestamp is present

Pack fda-524b 1.0.0

Severity: warning
An NTIA baseline attribute. The guidance frames these as 'should', and in practice a missing baseline attribute returns as a review deficiency or an eSTAR technical screening hold rather than a refusal, so it costs weeks rather than the filing.
Applies to: cyclonedx, spdx
Selector: {"cyclonedx":"$.metadata","spdx":"$.creationInfo"}
On an empty selector: fire
The selector names a specific object the assertion inspects. When that object is absent the information the rule exists to check was not supplied at all, which is a stronger failure than supplying it badly. Reporting nothing would make a missing section indistinguishable from a satisfied one.
Fix: Record when the SBOM data was last updated.
Source: ntia-2021: Minimum elements, baseline attributes table
Note: NTIA 2021 BASELINE, not CISA 2026. FDA has not adopted the 2026 element set.

Check a file against this

npx stratifypro check sbom.json --pack fda-524b
npx stratifypro explain FDA-NTIA-007 --pack fda-524b prints this page.