I need to look through the SCAP code but, since the order of ciphers is unimportant on the daemon side, wouldn't you want the check side of this to be a regex such that people can use the same cipher setting for both ssh_config and sshd_config?
I would modify the order of the remediation statement in this patch to match the strong -> weak order as well as a hint to the local admin.
I tend to list from strongest to weakest for ssh_config and just re-use the string in sshd_config for consistency.
There should be a check (I apologize if there is and I just didn't check enough) for the Ciphers setting in ssh_config as well to order the ciphers from strongest to weakest since order matters in the client file.
Yes, I know that the client file can be overridden by the user but, since most users don't do that, it's a good idea to set it appropriately.
Thanks,
Trevor