Add the instruction about the scanning policies

Based on: uis/devops/iam/card-database/feedback#593 (comment 464949)