docs(federal): add a Potential Agency Impact (PAIN) ratings guide

[skywalke34]

Description

Documentation only. Adds docs/content/federal_compliance/pain_ratings.md, a full page on the FedRAMP Class C Potential Agency Impact (PAIN) workflow, and places it after Remediation Deadlines in the Federal Compliance section.

Remediation Deadlines already documents the Use PAIN Ratings for VDR Deadlines toggle, the twelve-cell matrix, and the unrated / N1 behaviours (#15719). This page carries what that page has no room for, and links back to it rather than repeating it:

• The FedRAMP requirement in brief. The N1–N5 scale in FedRAMP's own customer-effect wording, the Class C timeframe table with its LEV/IRV, LEV/NIRV and NLEV column definitions, the note that Class C replaced the Moderate baseline, and the adoption timeline — optional from July 4 2026, required December 7 2026 under CISA BOD 26-04, grace ending March 7 2027. The existing page carries only the December date.
• How a deadline is calculated. The three-step order — base SLA, then the KEV cap, then the VDR/PAIN cap as a minimum — plus the two invariants somebody enabling this needs to predict: VDR only ever tightens a deadline, and PAIN tiering replaces the flat tiers rather than blending with them.
• A worked example with before/after screenshots. One KEV-listed, internet-reachable Log4Shell finding: 4 days on the flat tier, back to its 30-day base SLA once PAIN tiering is on and the finding is unrated, then 2 days once rated N5.
• Assigning ratings with Rules Engine 2.0. The Set Potential Agency Impact (PAIN) action and its behaviours (writes the rating and the PAIN Evaluated stamp together, skips findings already at the rating, recalculates the SLA on save, rejects values outside 1–5, leaves a per-finding run trace), finding.pain_rating as a filter condition, and a complete rule with its trace.
• The two FedRAMP Class C rule templates, and where the deadline surfaces afterwards — findings tables, the Approaching SLA Violation widget, notifications, reports, and the POA&M Scheduled Completion Date frozen at item creation.

One correction to remediation_slas.md while in the same section: that page said FedRAMP measures remediation timeframes "from evaluation rather than from discovery." Deadlines are computed from the finding's SLA start date — its discovery date — with the PAIN Evaluated timestamp kept alongside for reporting on when each impact decision was made. The distinction matters to an assessor, so the sentence is corrected and the new page states the behaviour plainly. The rest of that section is left intact, and a pointer to the new page is added.

Relationship to #15924 and Pro PR 2976

This complements #15924, which points the existing VDR/PAIN/KEV wording at the FedRAMP VDR & PAIN Tiering section of the SLA configuration form and the /api/v2/sla_configurations/ API, paired with DefectDojo-Inc/dojo-pro#2976 (milestone 3.3.100). The two do not overlap: #15924 edits the two paragraphs in remediation_slas.md that say where the fields live, while this PR adds a new page and touches a different paragraph. This page deliberately describes configuration on the SLA configuration without naming the form section, so it stays accurate before and after 3.3.100 ships; the screenshot of that form section is left for #15924 to carry.

Test results

Docs-only change; no code, no behaviour change in this repository.

• cd docs && npm ci && npm run build -- --environment development — clean, no errors. Plain npm run build (production, 1026 EN pages) is also clean. Only the Hugo deprecation warnings that already fire on dev.
• Served the site locally and checked the rendered page in a browser: all 10 added images decode (naturalWidth > 0, none broken) and all 10 images plus all 9 internal links return HTTP 200, including the relative ../poam_ledger, ../conmon_snapshots and ../remediation_slas forms.
• Every image added is referenced and every reference resolves; no orphans.
• Prev/Next renders as ← Remediation Deadlines / CMMC Level 2 Assessments →, confirming the weight-5 placement.
• Proofread the page against the source write-up: the twelve matrix cells, the 4/14/30 flat tiers, the 30/90/180 base windows, the EPSS default of 0.1, and all four dates match. The technical claims were checked against the paired Pro source.

Screenshots were captured on a DefectDojo Pro instance running the FedRAMP demo dataset, and continue the section's image numbering from 08.

Documentation

This PR is the documentation. English only; translations follow the normal i18n-translate refresh described in docs/TRANSLATIONS.md.

Checklist

• Submitted against dev: new documentation, per readme-docs/CONTRIBUTING.md.
• Rebased on the latest dev (branched from upstream/dev).
• Meaningful PR name, suitable for release notes.
• Documentation included — this PR is the documentation.
• Proper label applied (docs).

🤖 Generated with Claude Code