> Are those
> indications sufficient for addition to the SSG, perhaps with a low
> severity?

For the security discussion (non-compliance) portion, it's certainly
worth including as a discussion point (and making available as a Rule
for parties who may have specific use cases where this might really
matter).  For a baseline with a wide audience such as the STIG, I had
argued against inclusion.  But if you feel that there's value in
enforcing this as a compliance check (which is to say, that the security
benefits outweigh the costs as part of maintaining the baseline as well
as of enforcement itself), please say so and throw a patch up to the list.