FDA-TRACE-001 info

The SBOM can be traced to the threat model and risk assessment

Pack fda-524b 1.0.0

Severity: info
The guidance asks for traceability between the threat model, the risk assessment, the SBOM and testing, and separately for each architectural asset to trace to its SBOM component. Neither link can be verified from the SBOM alone, so this rule exists to put the requirement in front of the preparer rather than to test it.
Applies to: cyclonedx, spdx
Selector: {"cyclonedx":"$.metadata","spdx":"$"}
On an empty selector: fire
The selector names a specific object the assertion inspects. When that object is absent the information the rule exists to check was not supplied at all, which is a stronger failure than supplying it badly. Reporting nothing would make a missing section indistinguishable from a satisfied one.
Fix: Carry a stable reference in the SBOM that the threat model and risk assessment can cite back to, so a reviewer can follow one artifact to the next.
Source: fda-premarket-2026-02: Sections V.A and V.B.2, traceability
Note: PARTIAL CHECK, and a signpost to a second product: cross-artifact traceability has no commercial tooling at all.

Check a file against this

npx stratifypro check sbom.json --pack fda-524b
npx stratifypro explain FDA-TRACE-001 --pack fda-524b prints this page.