add recommendations on top of the schema

[afeld]

As an example, we noticed in cloud-gov/compliance#91, FedRAMP has parameters at various levels in controls.

We should decide how we want to specify these, for consistency. For example, are there any controls that have multiple top-level parameters? How would that work?

https://web.nvd.nist.gov/view/800-53/Rev4/control?controlName=SC-10

There should be some overall guidance around how to format the keys for consistency, and thus for ease of automated templating.