"The only thing it lacks is support, which the CIO doesn't want"
There's more than that it lacks, even for the basic customer. Something more important (to me, at least) that it lacks - RHN. RHN is great. Yeah yeah, one can set up a spacewalk server and update locally. I know. But...why?
Another thing CentOS lacks which is extremely important in the industrys I tend to work in: certifications. Has CentOS been EAL certified at any level? No. Will the DoD let you use RedHat over CentOS? No. Will a PCI auditor be a fan of your use of CentOS for your externally-facing website that processes credit cards? No. Does CentOS have enterprise-level QA processes for each and every thing that they are (because they are...) modifying? No. Would the FDA be happy with an OS vendor with no QA process? No. What's the indemnification that CentOS will give you in suits against Microsoft?
It's not as though the options are "CentOS" versus "Redhat with full support" after all. There's the
self-support option, which just gets you access to allllllll the other things. And you can even be "that place" that has 500 servers but only bothers getting 50 seats...eh, whichever, won't really matter except for the indemnification part.
I mean, what industry are you in that the question is even worth pondering? If you handle money, sensitive material, or PHI you'll spend WAY more than that tiny self-support price in the bribes and obfuscation necessary to get ok'd with CentOS. I mean hell,
Fedora has a more extensive QA process than CentOS. Maybe you should just tell your boss you agree with him so much you think you should use Fedora!