This new page, tentatively called Compliance Guide (open to other suggestions), gives agencies some more specific guidance on what's being asked of them by this policy.

The primary impetus for writing this is to establish a clear plan for HSTS adoption that acknowledges the overwhelming number of subdomains, and clearly lays out a preference for HSTS preloading with an includeSubDomains policy.

If we lean on asking agencies to use includeSubDomains, then it follows that preloading is a necessity, because we can't expect most users to have visited the root domain once, especially when most agencies default to www as the default for their .gov site.

This potentially relaxes pressure on agencies to set individual HSTS policies on subdomains. While it's acknowledged herein that agencies should still set individual policies, I think it's an acceptable and constructive trade to diminish pressure to set individual HSTS policies by increasing the awareness and pressure to HSTS preload entire .gov domains. HSTS preloading is much more comprehensive and final, and builds to a vision of one day just preloading the entire TLD.

This also includes a few "compliance FAQ" answers, that have come up during the post-release period of Pulse, and gives us a space to expand things that are specific to OMB/GSA interpretation of the policy (as opposed to the general FAQ, which currently is an FAQ about HTTPS more generally).

A screenshot of its current form is included: