Are VDI Endpoints In Scope for CMMC Assessments?

VDI and CMMC Scoping: A Common Question

Virtual Desktop Infrastructure is increasingly popular as a strategy to limit CMMC assessment scope. When configured correctly, VDI can keep endpoints out of scope — but the configuration requirements are strict.

Requirements for Out-of-Scope VDI Endpoints

For an endpoint to be considered out-of-scope, ALL of the following must be true:

• No copy-paste: Clipboard sharing between VDI session and endpoint must be disabled
• No file transfers: Drive mapping and file sharing must be blocked
• No printing: Print redirection must be disabled (or only to CMMC-compliant printers)
• No screenshots: Screen capture capabilities must be restricted
• KVM only: The VDI session should only transmit keyboard, video, and mouse data
• MFA required: Separate multifactor authentication to the VDI server (e.g., hardware token or PKI with PIN)
• Server-side enforcement: All restrictions must be configured on the server side, not the client

If Any Restriction Fails

If any of these configurations allows CUI to reach the endpoint, the endpoint becomes a CUI Asset and is fully in scope. There is no partial credit — it's either completely isolated or fully in scope.

VDI can be an excellent scoping strategy, but it requires rigorous configuration management. Document your VDI configuration in your SSP and be prepared for assessors to verify these settings.