The VA has adopted the DISA STIG and CentOS has been approved for development servers.  I think there are enclave requirements, nevertheless, it can be used.

Mike


Date: Thu, 22 May 2014 17:06:32 -0400
From: Shawn Wells <shawn@redhat.com>
To: SCAP Security Guide <scap-security-guide@lists.fedorahosted.org>
Subject: Re: Scap for Centos
Message-ID: <537E66D8.9040604@redhat.com>
Content-Type: text/plain; charset=UTF-8; format=flowed


On 5/22/14, 3:43 PM, Derek Warner wrote:
> Any chance anyone is working on getting SCAP to work on CENTOS? I
> would love to use the scap security guide and secstate to validate
> CENTOS 6.5. Right now its a manual process going line by line in the
> RHEL 5 STIG. I would really love to find out if anyone has anything
> automated that works on CENTOS.

Given that CentOS isn't allowed on DoD networks, there is no STIG, no
common criteria, no support, and doesn't meet any of the mandatory
regulatory requirements, what's driving the need?