DISA has their list of approved Operating Systems. You can request they approve your configuration if its not already on the list and they will run Retina scans

DISA has their list of approved Operating Systems. You can request they approve your configuration if its not already on the list and they will run Retina scans and other checks on it to verify it is secure and then you can use it. Some products like RHEL are pre-vetted so you can just say I am using RHEL and check off that box on the form you must submit to your CTO every now and then. At least that's the way it was where I worked. I would use more nouns to describe everything and even give you a link to the site, but I think its CaC secured and I left the DoD a few years ago because of these very kinds of issues so I no longer have all this memorized.