TOSS must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/gshadow".
Once an attacker establishes access to a system, the attacker often attempts to create a persistent method of reestablishing access. One way to accomplish this is for the attacker to enable a new or disabled account. Auditing account modification actions provides logging that can be used for forensic purposes.
How this relates to the STIG checklist: STIG vs SCAP benchmark.