RHEL5 went EOL just shy of 6 years ago, and extended support ended three years ago. You must not have any sort of public / outside audit looking into things because that's crufty enough that it would more than likely be called out in such.