We generate backlog Jira stories for security requirements. Developers rarely move them into sprints because most security requirements require interaction with other teams whose SLA doesn't fit the developer sprint.
It would be helpful to get a burndown-like report for non-sprint Epics showing # in To Do, Open, In Progress, Done, assigned / not assigned, number of comments, most recent comment, and whatever else might give an idea whether there is activity on these non-sprint stories.
Such stories can remain hidden in the backlog until close to the time security approval is needed for deployment. Stories discovered late in the game can cause a great deal of heartburn. Late-cycle code re-work may invalidate a pen test, for example.
This non-sprint progress report would also be helpful for stories that span multiple sprints.
