Add rationale to the EXO baseline

[buidav]

💡 Summary

EXO has been transitioned to the new structure but is missing rationale for policy items.

Motivation and context

The rationale gives the user the reasoning of the importance of a policy item.

Implementation notes

Please provide details for implementation, such as:

• ADD Rationale section and text for each policy
  Note: Suggested format for Rationale
  • 1st sentence: Security risk if policy is not implemented.
  • 2nd sentence: How this policy minimizes this risk.

Acceptance criteria

How do we know when this work is done?

• All policy items have rationale sentences in place of TODO

[buidav]

Closed by #447