VDI isn’t new or experimental. It’s a proven, decades-old architecture. The idea is simple: CUI lives in one locked-down desktop in the cloud, and a user’s machine becomes a window into it. There’s less to protect, less to document, and less that can go wrong.
When the rules keep changing and AI keeps lowering the cost of attacks, shrinking what you have to protect is the most dependable way to reduce risk.
What is VDI, and why does it matter for CMMC?
VDI stands for virtual desktop infrastructure. You work on a computer that runs in a secure data center, not the one on your desk. Your laptop shows the screen and sends your keystrokes and mouse clicks. The files, apps and data stay on the server.
That matters for CMMC because of scope. Under CMMC Level 2, every asset that stores, processes or transmits CUI is in scope, plus everything that secures those assets and anything not separated from them. Every in-scope laptop has to be hardened, documented and shown to an assessor.
Under the CMMC rule (32 CFR 170.19) and the DoD Level 2 Scoping Guide, an endpoint that only runs a VDI client is an Out-of-Scope Asset, as long as it’s configured so no CUI is processed, stored or transmitted beyond keyboard, video and mouse. The virtual desktop environment is in scope. The laptop isn’t, though you should be ready to show assessors how it’s locked down.
For a longer walkthrough, read How VDI Can Simplify Your Path to CMMC Compliance.
Introducing PreVeil VDI
PreVeil VDI is a managed CUI enclave: a familiar Windows desktop in AWS GovCloud with PreVeil Email and Drive, Microsoft Office, Okta and ThreatLocker already set up for CMMC. CUI stays inside the enclave, so the laptops people use to reach it stay out of your assessment boundary.
It comes with a documentation package built for assessment, including a System Security Plan (SSP), standard operating procedures and a shared responsibility matrix. PreVeil VDI has been through multiple CMMC Level 2 assessments by C3PAOs, including PreVeil’s own, which scored a perfect 110.
Shrink the problem to the people who touch CUI
Most of your company never touches CUI. Sales, HR, accounting and the front office don’t open drawings or handle test data. So why should their laptops be part of your assessment?
That’s the core idea of PreVeil VDI. Instead of protecting every person, laptop and location, you protect one environment and the few people who use it. Fewer in-scope assets means less to secure, document and assess.
One requirement family often drops away entirely: Physical Protection. If all your CUI lives inside the enclave, there’s no CUI on your premises to lock up.
Built for a moving target
CMMC rules shift. If your CUI is spread across 20 laptops, every change means re-engineering 20 laptops and rewriting your documentation. With a managed enclave, the environment lives in one place. When a requirement changes, PreVeil updates the enclave and its documentation, and customers inherit the update instead of rebuilding.
Here’s how the 110 CMMC Level 2 controls split with PreVeil VDI:
VDI in the age of AI
AI makes attacks cheaper and faster to run. Several 2026 CMMC Summit keynotes, including Dr. Ron Ross on NIST and CMMC in the era of AI attacks, made the same point: assume someone will get in, and design so the damage stays small.
VDI helps in three plain ways:
- Fewer endpoints to attack. Three locked-down virtual desktops are a much smaller target than twenty laptops in twenty places.
- CUI never reaches the laptop. There’s no local file for malware to grab, and nothing for AI assistants, copilots or browser extensions on the laptop to upload, sync or index.
- Damage stays contained. Ross listed virtual machines as one way to limit the damage after a breach. A compromised laptop doesn’t hand over the CUI, because the CUI was never there.
It isn’t magic. Anything shown on a screen can still be seen. But keeping the data itself off the device removes the easiest paths out.
What it costs, and what it saves
PreVeil VDI is priced per user plus a flat annual platform fee. You only pay for the people in the enclave (three seats for the median customer).
What you save is the work you no longer have to do:
- Hardening, monitoring and documenting every laptop that touches CUI
- Physical protection for CUI on your premises
- Writing an SSP, procedures and a responsibility matrix from scratch
- Re-engineering when the rules change
VDI is one of four common paths to CMMC Level 2, and they often blend. Any of the other three can run with or without a VDI enclave.
| Path | Internal time | What drives the cost | Biggest risk |
|---|---|---|---|
| DIY | Highest | Tools plus internal hours. The hours are the cost people leave out. | Underestimating the documentation and evidence work |
| Partner-directed | High | A project fee that grows with your scope | A good plan your team has no time to carry out |
| Partner-led | Low | Per endpoint, per month, for as long as they run it | Your partner becomes part of your assessment |
| VDI enclave | Low | Setup cost, then a per-user subscription | Your share of the controls still has to be done |
To go deeper, watch two Summit sessions: Protecting CUI Without Overpaying: What to Buy, What to Skip, What’s Free and Four Paths to Compliance: Which Is Right for Your Company? Or download the guide DIY, Partner or VDI? Choosing Your Path to CMMC Compliance.
What VDI doesn’t do
VDI shrinks your scope. It doesn’t erase your responsibilities.
- People. You still train users, screen personnel and manage who gets access.
- Policy. You still own your policies, incident response and your share of the 38 shared controls, plus the 10 that are fully yours.
- Evidence. You still have to show an assessor that the controls work, every year you hold DoD contracts.
- Setup discipline. Laptops stay out of scope only if CUI never lands on them. That’s why PreVeil VDI blocks printing by default.
Before you pick any VDI provider, ask three questions: What documentation comes with it? What do I have left to do? Have customers passed assessments on it?
Frequently asked questions
Does the CMMC rule allow VDI to keep laptops out of scope?
Yes, when it’s set up correctly. Under the CMMC rule (32 CFR Part 170) and the DoD Level 2 Scoping Guide, an endpoint running a VDI client that only passes keyboard, video and mouse, with no CUI processed, stored or transmitted on it, is an out-of-scope asset. The VDI itself stays in scope.
Does VDI make my company CMMC compliant?
No. It shrinks what you have to protect. With PreVeil VDI, 62 of the 110 Level 2 controls are inherited, 38 are shared and 10 are entirely yours. People, policy and evidence are still your job.
Who needs to be in a VDI enclave?
Only the people who handle CUI. PreVeil’s median VDI customer put 3 people in the enclave out of a median company size of 20.
How does VDI help with AI-driven attacks?
AI lowers the cost of attacks, so the fewer places CUI lives, the better. With VDI, CUI never lands on the laptop. There are fewer endpoints to attack and no local files for an attacker, or an AI tool on the laptop, to copy, sync or index.
When is VDI not the right choice?
If most of your company handles CUI, you work from one building you control, your devices are company-issued, and you have strong IT staff who know NIST 800-171, hardening your own endpoints may cost less.
This post is educational and is not legal advice. Confirm your scope and approach with your assessor or RPO before you commit to a path.
