VDI and CUI: A Good Solution to Reduce Your CMMC and CPCSC Compliance Scope?

If you are looking to comply with the requirements of CMMC or PCCC, you have likely already heard of Virtual Desktop Infrastructure (VDI).

This technology can allow users to access Controlled Unclassified Information (CUI) without their workstation necessarily being included in the scope of compliance. However, it is not an automatic solution. In fact, its configuration must meet specific conditions for the endpoints using it to be considered out-of-scope.

In this article, we explain how VDI works, what the CMMC guidelines provide, and the conditions that must be met to use this approach in a compliance context.

What is a VDI?

A VDI solution is a platform that allows you, via an intermediary system, to access resources or applications available on systems. The user who wants to access CUI data uses their computer and connects to an intermediary system (the VDI server). Once connected to the VDI, they can launch the application and view the data.

The principle is therefore to separate the physical workstation from the environment in which sensitive data is processed, stored, or transmitted.

‍

Is VDI recognized under CMMC?

The Department of Defense (DoD) CMMC Level 2 Scoping Guide explicitly recognizes that an endpoint using a VDI client can be considered out-of-scope when its configuration prevents the processing, storage, or transmission of CUI on the endpoint itself.

The guide specifically states: “An endpoint running a VDI client configured to prevent the processing, storage, or transmission of Controlled Unclassified Information (CUI), except for keyboard, video, and mouse (KVM) exchanges with the VDI client, is considered out-of-scope.”

In other words, simply using a VDI is not enough. It is the configuration of the VDI and the controls surrounding it that determine whether the endpoint can be considered out-of-scope.

What conditions must be met?

For a workstation using a VDI to be considered out-of-scope, certain conditions must be met. For example:  

• The workstation using the VDI must not be able to store, process, or transmit CUI.

• Your VDI solution configuration must block everything that is not related to the basic display of CUI on the users' screens.  

• Workstations outside the scope must not be able to mount the shared directory that stores CUI.

• The configuration must prevent copying (e.g., screenshots), saving, or printing CUI on the workstation.

• The configuration must require MFA authentication to access the VDI server.

As you can see, implementing a VDI solution comes with constraints that you must strictly adhere to if you want to be CMMC or PCCC compliant.  

The following diagram summarizes the VDI configuration in a CMMC or PCCC context.

The benefits of VDI for compliance

When properly configured, VDI can offer several advantages for a CMMC, PCCC, or NIST SP 800-171 compliance project.

• User computers accessing resources in VDI mode are considered out of scope for CMMC, PCCC, or NIST 800-171 compliance. Consequently, the protection requirements for computers accessing CUI (hard drive encryption, robust access control, security vulnerability management, etc.) do not apply to these computers.  

• Reducing the scope could save you money if you have multiple users accessing this CUI, as protecting their computers is not mandatory.

VDI can also be considered for certain BYOD (Bring Your Own Device) environments.

A user can access their virtual environment from a personal device without that device directly processing or storing CUI, provided the VDI configuration meets the applicable requirements.

However, this does not mean it is recommended to leave personal devices unprotected. Reducing the scope of compliance does not mean reducing cybersecurity requirements.

The limitations and constraints of VDI

VDI also has limitations that must be considered before choosing this approach.

• A VDI platform is rigid, with a limited user experience: you cannot print, copy, or store CUI on your computer.

• Increased risk of CMMC, PCCC, or NIST 800-171 non-compliance. Just because you use a VDI platform does not automatically mean that user computers will be considered out of scope. The CMMC or PCCC auditor will want to ensure that the VDI configuration is adequate to justify their exclusion from the scope. If, for example, the auditor realizes that copying and pasting data is possible, that CUI file transfers are possible, or that USB drives or printing remain enabled, they will conclude that your VDI solution is not working properly. In that case, they will consider all computers used to collect, store, or process CUI to be within the CMMC or PCCC scope. Your CMMC or PCCC audit will be a failure.

• Increased risk of intrusions if you focus solely on CMMC/PCCC compliance without considering security holistically. A poorly protected computer makes an organization vulnerable to cyberattacks.

• Implementation and maintenance costs can be high and require specialized expertise.

• Potential duplication of costs for companies that must be both PCCC and CMMC compliant.

When is VDI appropriate?

VDI can be particularly relevant when users need to view CUI without the need to download, locally modify, or print it.

For example, an organization that receives CUI from a prime contractor or partner could use a VDI environment that allows its authorized employees to view this information while keeping the data within a controlled environment.  

In this type of scenario, limiting local workstation functionality may be acceptable since the primary goal is data access, not local use.  

If you need more flexibility or need to print, create, or modify CUI on your computer, you should consider other solutions such as:

• Creating an internal CUI server (file sharing server) that meets CMMC or PCCC requirements.  

• Using a FedRAMP (Moderate or High) enclave offered by a cloud service provider.

• Implementing an internal enclave (such as the StreamEnclave platform from Streamscan) that will allow you to store, modify, or create CUI. StreamEnclave is a compliance platform that comes with the security tools required by CMMC, a data storage system with FIPS 140-2/3 encryption, security policies, and an SSP. It allows you to become CMMC or PCCC compliant in just a few weeks.

Compliance and cybersecurity: two complementary challenges

Reducing the scope of your CMMC or PCCC compliance does not mean reducing your cybersecurity risks. Even when a VDI solution is properly configured, the workstations used to access CUI can remain exposed to cyber threats. An inadequately protected endpoint can, in particular, become an entry point for an attack and compromise your organization's security.

At StreamScan, our expertise in incident response reminds us of the importance of maintaining robust cybersecurity measures, beyond mere regulatory requirements.

The goal is therefore not only to meet compliance requirements, but to implement an environment that truly protects your data and operations to avoid being notified by the DoD or the Canadian Department of National Defence in the event of an incident affecting their data.  

Which approach should your organization prioritize?

VDI, dedicated enclave, or internal infrastructure: the choice of solution depends on your operational needs, your technological environment, and the requirements your organization must meet.

Are you looking to reduce your CMMC or PCCC scope without compromising your cybersecurity?

StreamScan's experts can assist you in evaluating your environment and identifying an approach tailored to your compliance and security challenges.