💡 Summary

Allow users to indicate which controls should be omitted from the ScubaGoggles report and specify the rationale for doing so.

Motivation and context

Feature recently added to ScubaGear. See:

• https://github.com/cisagov/ScubaGear/blob/main/docs/configuration/configuration.md#omit-policies
• Report on ignored policies ScubaGear#740

Implementation notes

Related epic: #161.

PR for this feature on ScubaGear: cisagov/ScubaGear#1200.

Example config file on ScubaGear: https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/Sample-Config-Files/omit_policies.yaml.

Acceptance criteria

• Controls can be omitted via the config file
• Config file allows you to indicate the rationale
• Config file allows you to indicate an "expiration date," the date after which the control should no longer be omitted
• The Reporter has been updated to properly display the omitted policies
• Feature has been documented in the Readme files