Update annual-report-2022.md

Author: rficcaglia

wg-policy/annual-report-2022.md

@@ -5,27 +5,31 @@
 1. What work did the WG do this year that should be highlighted?
    For example, artifacts, reports, white papers produced this year.
 
-   -
-   -
+   - [Policy Whitepaper]()
+   - [PolicyReport CRD]() Adapters, [list here]()
+   - [Review of whether to KEP or not to KEP for Policy Report]()
    -
 
 2. What initiatives are you working on that aren't being tracked in KEPs?
 
-   -
-   -
-   -
+   - The main topic of discussion is now whether to KEP the PolicyReport, or just keep it in a sig (e.g. sig-auth)
+   - Outside of that there has been a lot of community interest, and workgroup effort spent, on control mapping
+     and control-as-code implementation, eg OSCAL, that might be better served moved into its own workgroup or a 
+     sandbox project
 
 ## Project health
 
 1. What's the current roadmap until completion of the working group?
 
-   -
-   -
-   -
+   - We intend to wrap up the workgroup once the KEP for PolicyReport is created OR sig-auth or another sig accepts it
+   - Or if neither occurs
+   - There is considerable interest in continuing the governance and assessment and lifecycle of policy and controls,
+     however as these necessarily cross boundaries, it seems like something that should either be re-homed to sig-security,
+     and/or hosted in a CNCF-level workgroup and/or moved into a relevant sandbox CNCF project, eg. [SLEDGEHammer]().
 
 2. Does the group have contributors from multiple companies/affiliations?
 
-   -
+   - Yes, RedHat, IBM, SunStone Secure, Nirmata, Google, ...
 
 3. Are there ways end users/companies can contribute that they currently are not?
    If one of those ways is more full time support, what would they work on and why?