in relation with applying sshd remediations, wondering if
the fix should enforce restart of sshd (include command ensuring it).
Yes, if the service must be restarted to assert the desired posture.
One reason for this is that the compliance check may not (typically
does not) compare the creation time of the service process(es) with
the modification time of the service configuration(s) to ensure that
the desired configuration has been adopted. This applies to
"services" other than daemons. In general, if a configuration is
changed, the system should be instructed to adopt the altered
configuration (but not necessarily during the application of the
remediation).
No, if it does not require restart (e.g., firewalld).
While the subject question implies a change, idempotency of
remediations has not much been discussed. Perhaps it should be
discussed, including whether a remediation procedure that finds no
remediation is required (because the system already has the desired
posture) does not perturb the system. Such idempotency would of
course potentially be at odds with XCCDF
<fix> attribute assertions.