The first decision is who will operate your CMMC environment. A hosted email service protects collaboration; a hosted VDI service supplies remote desktops; a standardized software kit lets your organization build and operate the environment it needs. These models can overlap, but they are not interchangeable purchases.
Where Each Approach Works Best
Hosted Email and File Sharing
A good fit when protected collaboration is the main gap and you prefer the vendor to run that service. Check how users work with files on endpoints, what data categories the service supports, and which controls and evidence remain your responsibility.
Hosted Virtual Desktops
A good fit when distributed users need provider-operated desktops and the offered applications and capacity match the workload. Validate performance, peripherals, connectivity, concurrent sessions, and the total cost of the desktops you actually need.
A Customer-Deployed Standardized Software Kit
A good fit when you want to control the environment, reuse infrastructure and Active Directory, support specialized local workloads, or operate an isolated enclave. Your staff or authorized MSP must have the capacity to deploy, configure, monitor, and maintain it.
Start with Who Runs the System
AIC CMMC Complete™ is a standardized commercial software kit that customers deploy and operate. Install the software on your own hardware and software, or use networking and virtual machines from a commercial cloud provider in a company-controlled account. Preconfigured marketplace instances provide another starting point.
Your organization controls the environment and authorizes access for its employees, MSP, and qualified solution providers. Analog Informatics supplies the software and does not host or manage your systems. Deployment, configuration, and FCI/CUI data migration are the client's responsibility, typically with an MSP.
Deploy on premises, in an isolated enclave, on supported air-gapped systems, or on existing infrastructure. Choose customer-managed cloud infrastructure when its services and data-handling obligations fit your requirements.
The software is built by the team behind privileged access solutions for sensitive US Government and prime contractor environments with security demands beyond typical CMMC deployments.
Compare the Model Before the Price
A hosted subscription can combine software, infrastructure, and operations. Customer-operated software lets you select those layers separately and reuse infrastructure and skills you already have. Neither arrangement makes every service or security requirement disappear.
- PreVeil describes a cloud-based encrypted email and file-sharing service.
- Microsoft GCC and GCC High are government cloud collaboration offerings. They are not the same product or the same thing as a complete CMMC operating program.
- NtelSec CUI Vault describes a GCC High virtual desktop service with CMMC workflows.
- AIC CMMC Complete™ provides customer-operated technical controls and evidence workflows, with package scope defined by level.
Email, virtual desktops, and enterprise security controls cover different responsibilities. Compare the complete environment your organization needs.
Which Is Cheaper?
Reusing your infrastructure can reduce recurring hosted-service costs. AIC can be a lower-cost fit when you already have suitable servers, directory services, backups, and people to operate them. Compare the complete cost over the same term to identify your savings.
- Software and the actual licensed users, mailboxes, managed systems, and modules.
- Hardware or cloud compute, storage, networking, backup, and disaster recovery.
- Microsoft or other third-party licenses, including any VDI platform.
- Setup, patching, monitoring, incident response, and ongoing administration.
- Independent assessment, evidence preparation, and exit or migration costs.
A hosted service may be economical when you need the provider to operate the environment. Customer operation can be economical when you can reuse what you own. Ask for a matched quote as your users, mailbox count, and workload grow.
AIC CMMC Complete™ Pricing is the single source for current package prices and allowances. The client and its MSP are responsible for configuration and FCI/CUI data migration. Include that work, infrastructure, third-party licenses, and independent assessment in the total.
What the SaaS Email/VDI Quote Must Disclose
A per-user SaaS price does not explain the VDI capacity behind it. If a provider does not publish hosting charges or capacity limits, mark them as undisclosed and obtain a written quote. Do not assume unlimited desktops, compute, or storage.
- Are virtual desktops included, separately billed, or metered by session or usage? What is the total at your peak concurrent sessions?
- What CPU, RAM, storage, GPU, and persistent desktop sizes are available? What are the maximum sizes and upgrade costs?
- Which engineering, CAD/CAM, business applications, peripherals, and local file workflows are supported?
- What are the session-duration, idle timeout, storage, bandwidth, and data-transfer limits?
- What changes when you add mailboxes, auditor or MSP accounts, sites, or workload capacity?
- Who patches and monitors the environment, retains logs, handles incidents, restores backups, and supplies assessment evidence?
With AIC, you select and pay for your own infrastructure and any VDI platform. That makes the infrastructure choices visible to you; it does not make compute, storage, administration, or third-party licensing free.
Which Is More Flexible?
Customer operation gives you control over where the system runs, how it connects to your existing Active Directory, and how authorized auditors and MSP staff receive access. Assign named identities and appropriate roles, retain audit records, and scope access to the work each person needs.
Expand mailboxes and capacity to meet your requirements rather than redesigning around a hosted desktop workflow. Software entitlements, third-party licenses, infrastructure capacity, and security requirements still apply; confirm quantities in your agreement.
If VDI suits your workflow, use your own supported VDI environment on premises or in your cloud account. Choose the desktop technology, isolation, access policy, and scale appropriate to your business. VDI is an architectural choice, not a substitute for securing the complete assessment boundary.
Which Is More Secure?
Customer control enables isolation and security choices that a fixed hosted-service offering may not expose: air gaps, enclave boundaries, your own identity infrastructure, restricted administrative paths, and your chosen monitoring and backup systems.
Security depends on the implementation and its operation. Your team or provider must configure and maintain access controls, encryption, patching, logging, recovery, and incident response. A well-operated hosted service can be safer than a poorly maintained local system. Evaluate demonstrated controls, responsibilities, and evidence rather than assuming either location guarantees security.
Do You Need GCC High or FedRAMP?
CMMC does not prescribe a Microsoft product. An on-premises design can meet applicable requirements without buying GCC High simply to use AIC. Your contract, information category, export restrictions, and other connected services determine the obligations.
For an on-premises system that does not use an external cloud provider to store, process, or transmit covered defense information, the external-cloud condition in DFARS 252.204-7012(b)(2)(ii)(D) is not triggered by the local AIC software itself. This is a deployment distinction, not a blanket waiver of CMMC, NIST, or contract requirements.
Your own commercial-cloud account is still external cloud infrastructure. If it stores, processes, or transmits covered defense information, applicable cloud requirements remain. DFARS 252.204-7012 calls for FedRAMP Moderate-equivalent security and additional incident-response obligations. Tenant ownership alone does not waive them; verify the exact service offering, boundary, and shared responsibilities.
DoD guidance explains the evidence required for FedRAMP Moderate equivalency. Microsoft describes different supported data and compliance boundaries for GCC, GCC High, and Azure offerings. Choose the services your actual data and contract permit, rather than assuming every commercial service is acceptable or every CMMC deployment needs GCC High.
From CMMC Level 1 to Broader NIST Programs
AIC offers kits for CMMC Level 1, Level 2, and Level 3, plus controls and evidence workflows supporting NIST SP 800-53 programs. These are distinct frameworks and package scopes, not interchangeable certifications.
Use the requirements mappings to see what the software performs, assists, or records and what your organization must implement. Choose your deployment and licensed capabilities around that boundary.
Choose Your Deployment
Bring your data flows, current infrastructure, directory, user and mailbox counts, remote access needs, and operating responsibilities. Use these requirements to select the software kit and plan deployment with your staff, MSP, and qualified solution providers.
Explore AIC CMMC Complete™ · Compare CMMC Approaches · Read the Deployment Comparison and FAQ
Sources
- DFARS 252.204-7012
- DoD FedRAMP Moderate Equivalency Guidance
- Microsoft Commercial and Government Cloud Boundaries
- PreVeil
- NtelSec CUI Vault
Frequently Asked Questions
Is AIC CMMC Complete™ a SaaS Service?
No. It is a standardized commercial software kit the customer deploys and operates. Analog Informatics does not host or manage the customer's CMMC systems.
When Does Hosted SaaS Email Work Best?
Hosted email and file sharing can fit organizations whose primary need is protected collaboration and that prefer a provider to operate that service. Confirm endpoint responsibilities, supported data categories, integrations, and assessment evidence. Email protection alone does not provide every CMMC requirement.
When Does Hosted VDI Work Best?
Hosted VDI can fit distributed teams that want provider-operated desktops and centralized applications. Confirm the available desktop sizes, supported applications and peripherals, concurrent sessions, network performance, and full hosting charges before selecting it.
When Does Customer-Hosted Software Work Best?
It can fit organizations with suitable infrastructure and a qualified team or MSP, local or isolated workloads, existing Active Directory, specialized applications, or requirements to control the operating environment. The customer remains responsible for configuration, operation, and evidence.
Can We Run AIC on Commercial Cloud Virtual Machines?
Yes. Customers can deploy the software on company-controlled virtual machines and networking. The underlying provider's services still need to meet the obligations applicable to the data and contract. Control of the VM does not by itself establish that the infrastructure is outside external-cloud requirements.
Does CMMC Require GCC High?
CMMC does not mandate a Microsoft product. An on-premises deployment can avoid buying a hosted collaboration service simply to run AIC. The permitted email, cloud, and infrastructure services depend on the contract, information, and applicable safeguarding requirements.
Who Migrates Our FCI/CUI Data and Configures the System?
The client is responsible, typically working with an MSP or another qualified provider under the client's control. Analog Informatics supplies the software and does not perform CMMC data migration or manage the customer's systems.
Which Approach Is Cheaper or More Secure?
Compare the same users, workload, controls, infrastructure capacity, operating labor, and assessment responsibilities. Existing infrastructure can make customer operation economical; provider operation can help a team without that capacity. Neither deployment model alone proves lower total cost or stronger security.