VDI for CMMC
The simplest, fastest route to CMMC available today
The Challenge: CMMC Is Complex
Configuring and documenting every device that touches CUI is a major project. Most contractors lack the in-house expertise, and those with mature IT teams rarely have the time to dedicate to it.
The Solution: PreVeil VDI
One managed environment that takes most of the work off your plate. CUI stays inside the VDI, so your laptops stay out of scope, and 62 controls are fully inherited.
“ PreVeil’s VDI is a game-changer. It keeps endpoints out of scope, so there’s far less for me to assess and clients get certified faster and more cost-effectively. “
Dan Ciarlette
Lead CMMC Assessor
Get to Know PreVeil’s VDI
Endpoints Out of Scope
A familiar Windows desktop, accessible from any device. CUI stays inside the enclave, so the physical endpoint never enters your assessment boundary.
A Compliant Tech Stack
PreVeil Email & Drive, Okta, ThreatLocker, Microsoft apps, and AWS GovCloud, integrated and configured for CMMC out of the box.
Assessor-Validated Documentation
SSP, SOPs mapped to all control families, Shared Responsibility Matrix — ready to hand to your C3PAO. A Customer Readiness Checklist walks you through each step it takes to get compliant.
Proven in C3PAO Assessments
PreVeil’s VDI has passed multiple CMMC assessments—preferred C3PAOs who know the environment can get assessments done faster.
Take a Tour of PreVeil VDI
Why 3,000 of the Leading Defense Contractors Use PreVeil
Proven Compliance
100+ contractors have used PreVeil to achieve CMMC, and our VDI earned a perfect 110
Easy to Use
Connect from the Windows or Mac computers you already have and work in a familiar Windows desktop
Less Work for You
Inherit 62 of the 110 NIST controls, keep your laptops out of scope, and get expert guidance on the rest
Not sure whether to secure your own endpoints or move to VDI?
Both paths can get you to CMMC — but there are tradeoffs.
Securing your own endpoints is the most economical, but requires internal IT expertise and bandwidth.
VDI takes endpoints out of scope entirely, simplifying your path to certification at a premium.
Interactive SRM
Map your controls for each path
Endpoints vs. VDI
Pick the right path for your organization
Proven to Deliver CMMC & ITAR Compliance
Defense contractors & C3PAOs have used PreVeil to achieve CMMC compliance with perfect 110 scores
Defense Contractor
“We got the GCC High quote and it was just crazy: It was over $200,000 for 33 users…the PreVeil quote was 1/10th of that and checked every box“
Trusted by those who certify compliance. Used by those who must achieve it.
Frequently Asked Questions
How many of the 110 CMMC Level 2 controls do we inherit?
The Shared Responsibility Matrix (SRM) shows 62 controls fully inherited, 38 shared, and 10 owned by you.
Are our laptops out of scope? Do we need dedicated devices?
Generally, yes, they’re out of scope. A device that only runs the VDI client can be treated as an out-of-scope asset, as long as CUI never lands on it. You don’t need dedicated laptops; users connect from their existing Windows or Mac computers.
What do we still have to do?
You implement the 10 customer controls and your part of the 38 shared controls. That usually means completing the SSP, writing or adapting policies, managing your users, and collecting evidence for your own processes. You also manage ThreatLocker, which generally requires some IT background unless you offload it to a managed service provider.
What’s in the documentation package?
The package includes:
- An SSP template covering NIST SP 800-171 Rev. 2 controls and objectives
- SOP templates covering the NIST SP 800-171 domains
- The SRM
- Network and CUI-flow documentation
- Assessment readiness checklists
The templates use a placeholder example company, which you replace with your own details. You get access in the Compliance Accelerator as soon as your order is signed, even before your VDI is live.
Has PreVeil VDI been assessed?
Yes. PreVeil VDI has been through multiple CMMC Level 2 assessments by C3PAOs, including PreVeil’s own, which earned a perfect 110.
Is Microsoft Office included?
Yes. Microsoft Office, Adobe Acrobat Reader, and the Edge browser come pre-installed. You don’t need separate Microsoft licenses for the VDI.
What are the specs of each VDI workstation?
Each workstation runs Windows Server 2025 with 2 vCPUs, 8 GB of memory, a 175 GB root volume, and 100 GB of storage. If your workload needs more, talk to our team.
Can we install our own software?
Yes. Admins install applications and approve them in ThreatLocker. Some engineering applications aren’t supported on the standard VDI today, so confirm your applications with our team before you buy.
Can we print from the VDI?
Not directly. Printing is blocked by default, because printed CUI leaves the VDI and brings the printer into scope. If you need to print, our compliance team will help you find a compliant path, including through our partner SCI.
Can we mix VDI users with standard PreVeil users?
Yes. Many customers put a few CUI users on the VDI and keep everyone else on standard PreVeil.
How do primes send us CUI?
Primes can use a free PreVeil account, or they can email your Email Relay subdomain address. The Relay is optional; you can reach CMMC Level 2 without it. It uses a subdomain such as cui.yourcompany.com, so your main email domain stays where it is.
How does pricing work?
There’s a per-user price plus a flat annual platform fee, both paid annually. The per-user price includes Okta and ThreatLocker, and it drops at higher user counts. One admin license is included. Book a demo for a quote.
Ready to get started with PreVeil?
PROUDLY MADE IN THE USA
PreVeil is 100% Designed & Developed in the USA