I was going to add it to the SSG stack, but it seemed....awkward since I'm going to also have to add a bunch of my oval checks scattered around.
We too are a compliance solution, but we're an operations focused compliance solution as opposed to a checkbox compliance solution. The two are not mutually exclusive but they don't always have the same base goals.
Additionally, compliance is compliance with the *documentation*, not the scanner. Where the scanner differs from the policy, the policy wins because it is, in fact, the policy.
The main issue is that we're going to have to have *different* OVAL checks since there is no method for actually differentiating between a SIMP system and a stock RHEL system. All we do is configure RHEL, we don't actually make something different.
Given all this, it does seem like the correct answer is to just dive in and start rolling 'simp_' things all over the place. We'll start light and see how it goes from there.