HSTS Displays Disabled even though the header is present

My company is using Tenable to identify security vulnerabilities. Missing HSTS was identified recently. Our server is using IIS 10.

I've added the HSTS header as outlined in multiple blogs, and questions here on SO.

My root web.config looks like this:

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <appSettings>
        <add key="Environment" value="Local" />
    </appSettings>
    <system.webServer>
        <rewrite>
            <rules>
                <rule name="HTTP to HTTPS redirect global" stopProcessing="true" >
                    <match url="(.*)" />
                    <conditions>
                        <add input="{HTTPS}" pattern="off" ignoreCase="true" />
                    </conditions>
                    <action type="Redirect" url="https://{HTTP_HOST}/{R:1}"
                        redirectType="Permanent" />
                </rule>
            </rules>
            <outboundRules>
                <rule name="Add Strict-Transport-Security when HTTPS" enabled="true">
                    <match serverVariable="RESPONSE_Strict_Transport_Security"
                        pattern=".*" />
                    <conditions>
                        <add input="{HTTPS}" pattern="on" ignoreCase="true" />
                    </conditions>
                    <action type="Rewrite" value="max-age=31536000; includeSubDomains; preload" />
                </rule>
            </outboundRules>
        </rewrite>
    </system.webServer>
</configuration>

Problem: After the changes have been applied, Tenable is still showing a vulnerability. Further, upon inspecting a site in FireFox's dev tools, I can see the header is present, however the security tab indicates that HSTS is disabled.

Question: How do I make this change show up for Firefox and Tenable?