Why use CentOS when RHEL developer subs are free?

For our environment where we have a small deployment of only 2-4 machines, CentOS is much easier to manage off-line on an air-gaped network.  Mirroring the CentOS repos is pretty easy to do with reposync and monthly drops to a web server on the red network.  The CentOS workstations can then just point to the yum repos on said webserver and everything works like it's supposed to.  Trying to do this with RHEL-proper is frustrating at best.  A satellite server is way overkill for a deployment like this and setting up the clients for a "normal" yum repo requires removing and uninstalling all of the subscription / rhn packages.  There's also the simplicity of only have 2 system repos to worry about to get everything available in CentOS (Base + Updates) vs dealing with the dozens of channels needed in a RHEL subscription to get the same set of available packages.  I certainly get the value in all of the various options for managing large enterprise deployments but CentOS is just much simpler to deal with for us in a small deployment and software-developer-centric environment.  We end up using both RHEL and CentOS for different use cases but need to apply the same security framework and settings to both.

With regards to allowed security configurations, as a contractor we've never had issues with DSS and CentOS being allowed so long as we apply all the appropriate RHEL rules and can appropriately justify where we diverge.  The only ones I've run into that end up not applicable across the two have been FIPS related, which we have to disable anyways to accommodate third party unsigned kernel modules for the Nvidia driver.  The STIGs after all are just a guideline and place to start from so you can adapt it to your own environment with appropriate tailoring and justification, not a fixed "it has to be this way".  Most of the government entities we work with (DoD and DoE) use RHEL for their infrastructure servers and end-user workstations but CentOS for their projects and developer environments.  Many of the DoE labs we work with even use CentOS on their large scale HPC deployments (LANL, Sandia, LLNL, etc.) while others use RHEL proper.

- Chuck