Introducing PreVeil VDI
This brief explains what PreVeil VDI is, what’s included, and what it means for your CMMC compliance.
PreVeil VDI is a managed virtual desktop built for handling Controlled Unclassified Information (CUI). Your users sign in to a secure Windows desktop hosted in AWS GovCloud, and all of their CUI work happens there. CUI never lands on the computers they use to connect, so those computers can stay out of your assessment scope.
The result is a simpler path to compliance. You get one environment instead of a stack of separately configured tools. Most controls are already covered, so the list left for you is short, and the documentation templates come with it.
Why it matters now. The DoD’s pause on CMMC Phase 2 applies to third-party certification, not to the requirements underneath it. If you handle CUI, DFARS 7012 still requires the NIST SP 800-171 controls, and you still need a current self-assessment score in SPRS. PreVeil VDI gives you a simpler way to meet those requirements today. It also gives you an environment that’s ready for a C3PAO assessment if your prime or your contract calls for one.
Explore the product page
PreVeil VDI
Compare the paths to CMMC
VDI vs. Endpoints
See It in Action
Walk through the PreVeil VDI experience yourself in our interactive demo.
What’s Included
PreVeil VDI brings together everything a CMMC Level 2 environment needs:
- A dedicated, managed environment. You get your own virtual desktop environment on Amazon WorkSpaces in AWS GovCloud, which is FedRAMP High authorized.
- Okta for identity and access. Okta manages your users’ identities and controls who can reach the environment. Users sign in with multi-factor authentication through Okta Verify or a YubiKey.
- ThreatLocker application control. ThreatLocker controls which applications can run inside the VDI. Its SOC monitors for threats and escalates alerts to you.
- PreVeil Email and Drive. End-to-end encrypted email and file sharing for storing and exchanging CUI.
- Familiar apps. Microsoft Office, Adobe Acrobat Reader, and the Edge browser come pre-installed. You don’t need separate Microsoft licenses for the VDI.
- Compliance Accelerator documentation. The package includes:
- A System Security Plan (SSP) template covering NIST SP 800-171 Rev. 2 controls and objectives
- SOP templates covering the NIST SP 800-171 domains
- The Shared Responsibility Matrix (SRM)
- Network and CUI-flow documentation
- Assessment readiness checklists
- Optional: Email Relay. Email Relay lets primes and partners email you CUI at a dedicated subdomain.
Together, these cover the full technology stack. You don’t need to buy or integrate anything else.
How It Works for Users
Signing in. Users install the Amazon WorkSpaces client on the Windows or Mac computer they already have. They sign in through Okta and confirm with a push to their phone. No dedicated laptops are required.
Working. Inside the VDI, users get a standard Windows desktop with the apps they already know. They store and share CUI through PreVeil Email and Drive.
Keeping CUI inside. By default, policies inside the VDI block copy-paste, file transfer, and USB storage between the VDI and the local computer. CUI stays in the environment.
Compliance Impact
Most of the work is already done. Under the current SRM, 62 of the 110 CMMC Level 2 controls are fully inherited from PreVeil, and 38 are shared. That leaves 10 controls that are entirely yours.
Your devices stay out of scope. A computer that only runs the WorkSpaces client, where nothing but keyboard, video, and mouse crosses into the session, can be treated as out of scope. You don’t have to secure and document every laptop your team uses.
The environment has already passed assessment. PreVeil’s managed service offering, which includes the VDI and Email Relay, earned CMMC Level 2 certification with a perfect 110 score. PreVeil VDI has now been through multiple C3PAO assessments, including PreVeil’s own. Assessors can rely on PreVeil’s certification for the inherited controls. PreVeil also works with C3PAOs who are familiar with the environment and can offer assessments at a reduced rate.
ITAR and EAR data. PreVeil VDI supports ITAR and EAR data for authorized persons.
For a deeper look at how a VDI compares with securing your own endpoints, read How VDI Can Simplify Your Path to CMMC Compliance.
Who Manages What
[chip for srms]
FAQs
How many of the 110 CMMC Level 2 controls do we inherit?
The Shared Responsibility Matrix (SRM) shows 62 controls fully inherited, 38 shared, and 10 owned by you.
Are our laptops out of scope? Do we need dedicated devices?
Generally, yes, they’re out of scope. A device that only runs the VDI client can be treated as an out-of-scope asset, as long as CUI never lands on it. You don’t need dedicated laptops; users connect from their existing Windows or Mac computers.
What do we still have to do?
You implement your 10 controls and your part of the 38 shared controls. That usually means:
- Completing your SSP
- Adapting the policies to your company
- Managing your users
- Collecting evidence for your own processes
After handoff, you also manage Okta and ThreatLocker and make sure operating system updates are applied. That takes some IT backgrou
What’s in the documentation package?
The package includes:
- An SSP template covering NIST SP 800-171 Rev. 2 controls and objectives
- SOP templates covering the NIST SP 800-171 domains
- The SRM
- Network and CUI-flow documentation
- Assessment readiness checklists
The templates use a placeholder example company, which you replace with your own details. You get access in the Compliance Accelerator as soon as your order is signed, even before your VDI is live.
Has PreVeil VDI been assessed?
Yes. PreVeil VDI has been through multiple CMMC Level 2 assessments by C3PAOs, including PreVeil’s own, which earned a perfect 110.
Is Microsoft Office included?
Yes. Microsoft Office, Adobe Acrobat Reader, and the Edge browser come pre-installed. You don’t need separate Microsoft licenses for the VDI.
What are the specs of each VDI workstation?
Each workstation runs Windows Server 2025 with 2 vCPUs, 8 GB of memory, a 175 GB root volume, and 100 GB of storage. If your workload needs more, talk to our team.
Can we install our own software?
Yes. Admins install applications and approve them in ThreatLocker. Some engineering applications aren’t supported on the standard VDI today, so confirm your applications with our team before you buy.
Can we print from the VDI?
Not directly. Printing is blocked by default, because printed CUI leaves the VDI and brings the printer into scope. If you need to print, our compliance team will help you find a compliant path, including through our partner SCI.
Can we mix VDI users with standard PreVeil users?
Yes. Many customers put a few CUI users on the VDI and keep everyone else on standard PreVeil.
How do primes send us CUI?
rimes can use a free PreVeil account, or they can email your Email Relay subdomain address. The Relay is optional; you can reach CMMC Level 2 without it. It uses a subdomain such as cui.yourcompany.com, so your main email domain stays where it is.
How does pricing work?
There’s a per-user price plus a flat annual platform fee, both paid annually. The per-user price includes Okta and ThreatLocker, and it drops at higher user counts. One admin license is included. Book a demo for a quote.
