FDA-STAT-001 error

A software bill of materials exists and is machine-readable

Pack fda-524b 1.0.0

Severity: error
Section 524B(b)(3) is a statutory shall. FDA's temporal carve-out for cyber devices expired on 1 October 2023, after which section 524B information is by itself a sufficient basis for a Refuse to Accept decision. The absence of a machine-readable SBOM is the clearest case there is.
Applies to: cyclonedx, spdx
Selector: {"cyclonedx":"$","spdx":"$"}
On an empty selector: fire
The selector is the document root, which is present in every parsed document, so this rule can never see an empty selector. The value is declared because the field is required of every rule, and fire is the conservative choice should a future selector change make it reachable.
Fix: Provide a machine-readable SBOM. FDA names no format; industry-accepted formats are encouraged.
Source: fdc-524b: Section 524B(b)(3), 21 USC 360n-2(b)(3)
Note: STATUTORY. This is the only rule in either pack whose severity rests on normative language rather than on a documented consequence.

Check a file against this

npx stratifypro check sbom.json --pack fda-524b
npx stratifypro explain FDA-STAT-001 --pack fda-524b prints this page.