From what I know of the project, CMS has a GitHub enterprise account that they used internally to "iteratively create on github," this Repo is the one that moved over after release.

It's a big step to have government releasing ANYTHING on Github. And yes, it's the next logical step for them to start projects on GitHub. But they're not there yet -- its worth noting that neither Sunlight nor Code for America start their projects out in the open 100% of the time either. It's new ground, and government will, I think, move more towards developing out in the open as we progress. But for now, I'm pretty excited that they embraced technology from this decade.

I should note I'm the former Director of Sunlight Labs, and am an advisor to Code for America.

As I understand it, that's correct: built using Github Enterprise internaly and then published publicly. There was code in public, on the Development Seed account, with respect to coding for the project; anyone can go look at the commits there. Your other points speak for themselves.

Did GitHub go through FISMA certification for their public site? How are these govt agencies using the system to host code without getting the platform accredited?