No need to rebuild after enabling CSP.
It does look strange at first that these are independent checkboxes, but it might be useful in the future to have separate CSP and Report-only policies, both active (for example to facilitate testing new directives without disabling the current policy).