Self-hosted video conferencing for CMMC

The assessor looks for a written statement of how users present at a collaborative computing device are told that the device is in use, plus proof that it works. For Jitsi Meet, the producing evidence is the interface configuration and the deployment's customization files, such as the custom settings or interface config changes your team made, showing the visible in-meeting indicator for camera and microphone state. For BigBlueButton, capture the room settings and the client screens that show the active recording and presenter indicators. Under NIST SP 800-171A, the indicator objective is met only with evidence in final form, not draft screenshots or an unapproved runbook. Keep a dated, approved version of each document and a test record showing the indicator appears on a real endpoint. Confirm with your assessor which artifact format they accept.

Remote activation is prohibited by the combination of endpoint settings, browser permissions and meeting policy, and the assessor will ask to see each layer. On Jitsi, the evidence includes the deployment configuration that disables unsolicited joins, the authentication setting in the .env file (for example, the choice between internal XMPP accounts, JWT tokens or LDAP), and the approved client policy that blocks camera and microphone access without user action. On BigBlueButton, show the server configuration and the Greenlight v3 external authentication settings, which control who can start a room. Capture a test in which a remote session attempts to start a camera or microphone and is refused. The objectives under NIST SP 800-171A require each prohibition to be demonstrated, so keep the test output and the configuration diff together and final.

The answer is the TLS configuration that protects the web session, the signaling path and the media path, and the assessor will check each one. For Jitsi, the handbook states that HTTPS with a proper domain certificate is necessary for working audio and video, so the evidence is the certificate chain, the web server TLS configuration, and the Prosody and Jicofo settings that keep signaling encrypted. Media is carried over DTLS-SRTP by default in WebRTC, so record the Jitsi version and the transport ports, including 10000/UDP and the optional 5349/TCP fallback. For BigBlueButton, show the SSL hostname configuration and the TURN server settings. Under NIST SP 800-171A, you must identify the mechanism and show it operates in transit. Store the final configuration files and a packet or handshake capture taken from an in-scope client. Use the .env and nginx configuration as the primary references.

Control means you define which VoIP paths are approved, and monitoring means you can see their use. The assessor will ask for the approved-use statement, the network rules that allow only the conferencing ports, and the logs that show session activity. For Jitsi, the evidence set includes the firewall rules for 80/TCP, 443/TCP, 10000/UDP and any optional ports you open, the optional Jigasi SIP gateway configuration if you run it, and the Prosody and Jicofo logs. For BigBlueButton, include the firewall rules for 80, 443 and the 16384 to 32768 UDP range, plus the server logs. Forward these logs to your SIEM and keep the export as proof. A SIEM export is only useful if it is final and covers the assessment period. Ask your assessor whether they want the approved-use statement, the rule set, or a sample of logs.

Logs of meeting access are kept in the server log stores and in your SIEM, and the assessor expects them to be retained, protected and reviewed. Name each producing component: Prosody and Jicofo logs for Jitsi, the BigBlueButton server logs, the reverse proxy access logs, and the Greenlight authentication logs where it is used. Set a retention period in your policy, store logs off the media servers, and show a review record. Note that 45 CFR 164.312(b) is a useful model for audit controls in health settings, but CMMC evidence is judged against NIST SP 800-171A, so confirm which retention period your contract requires. Keep an export of a sample meeting session that shows who joined and when, and a dated review record that is final and signed off.

Yes, an internal team can produce most of this evidence, but the work is in documenting and testing, not just configuring. The main effort sits in writing final policies, capturing dated configuration and test records, and keeping a change history that matches the assessed state. Teams without assessment experience often find the evidence gaps only when an assessor asks for a final artifact. Ask a partner to review the evidence set against the three requirements and the assessment objectives before the assessment starts. DeployOpen prepares systems, controls and evidence for compliance assessments, but it does not issue audit reports or certifications, and independent assessors perform the Level 2 certification assessment. Ask any partner to put the scope and deliverables in writing before work starts.

The main cost drivers are the number of platforms in the enclave, the number of endpoints and rooms in scope, how much configuration is undocumented today, and how many environments must be evidenced. Preparing evidence is a one-time cost for the initial documentation and testing, and a recurring cost for re-testing, log review and change control after upgrades. The fact base does not give a price, and DeployOpen does not publish one, so ask for a quote tied to a written scope that lists the requirements, the platforms and the environments. Ask the vendor or partner to separate the one-time documentation effort from the ongoing log review and upgrade testing. Under 32 CFR 170.24, the affected requirements are each worth 1 point, and the rule allows a POA&M with closeout due within 180 days if the score is at least 88 of 110. Confirm the current status of the CMMC phases with your contracting officer before you commit.

Cost depends on the scope written into the engagement, and most of it is labor and evidence work rather than hardware. The BigBlueButton 4.0 install docs list a minimum of 16 GB of RAM with swap, 8 CPU cores with high single-thread performance, 500 GB of disk for recordings (50 GB without recording) and 250 Mbit/s symmetrical bandwidth for a single server. The Jitsi scalable setup guide suggests a 4 CPU, 8 GB machine for the central server and 4 or 8 CPU with 8 GB RAM for each videobridge. Cost drivers include peak concurrency, whether recording is enabled, endpoint policy for conferencing devices, identity integration, and the work to produce final-form evidence for each assessment objective. One-time costs cover design, build, hardening and documentation. Recurring costs cover hosting, bandwidth, patching and support. Ask any quote to separate these lines and to name who is paying for each task.

The duration is set by the written scope, not by a number on this page. A timeline should follow from the number of meeting servers, the identity source to connect, the endpoint and network changes needed, and how much evidence must be collected before an assessment. Check the platform prerequisites first, since the BigBlueButton 4.0 docs recommend a clean server installation on Ubuntu 24.04 and do not support direct upgrades from 2.6, 2.7 or 3.0. Also confirm the current CMMC schedule before you commit a date. On 13 July 2026 the Department of War suspended CMMC Phase II, and the DoW CIO's About CMMC page says implementation is paused in Phase 1, so a contract deadline may have moved. Ask for milestones tied to written acceptance criteria.

A capable platform team can deploy Jitsi Meet or BigBlueButton, but the CUI scope adds work beyond installation. Jitsi runs as several components, including a web server, Prosody, Jicofo and Jitsi Videobridge, and the Jitsi handbook says HTTPS with a proper domain certificate is necessary for working audio and video. The team also needs to own patching, monitoring, backup, access control and the evidence trail for requirements such as SC.L2-3.13.12, SC.L2-3.13.14 and SC.L2-3.13.8. Decide early whether staff can carry those duties during meetings and upgrades. Partial help is a common model, such as an outside team for design, hardening and documentation, with internal staff running daily operations. DeployOpen implements, hardens and documents self-hosted platforms inside your own infrastructure and supports them under written scope or retainer.

A partner needs accurate inputs to size and scope the work. Prepare a network diagram showing where meeting servers, TURN or STUN services, firewalls and the enclave boundary sit. The BigBlueButton docs list TCP 80 and 443 and UDP 16384 to 32768, while the Jitsi quick start lists 80/TCP, 443/TCP and 10000/UDP, so firewall rules must be mapped to each design. Also provide the identity source, since Jitsi supports internal XMPP accounts, JWT, LDAP and Matrix verification, and Greenlight v3 supports OpenID Connect. Gather the existing system security plan, the CUI data flow, the endpoint management tooling, hosting or colocation contracts, and any agreements with cloud or bandwidth providers that touch CUI.

No. A platform is one component of a compliance program, and compliance is determined by an assessment of your whole environment. A self-hosted platform gives you control over where meetings run, how users authenticate, how devices are signaled and how encryption is configured, which produces evidence for the practices. The assessment objectives in NIST SP 800-171A require that a requirement be met with evidence in final form, not drafts, and that depends on your policies, procedures, configuration records and monitoring. Ask any partner to map each platform setting to a specific assessment objective and to state which objectives remain your responsibility, such as endpoint policy and personnel training.

No. DeployOpen prepares systems, controls and evidence for compliance assessments, but it does not issue audit reports, attestations or certifications. Level 2 certification assessments are performed by C3PAOs authorized or accredited by the CMMC Accreditation Body, currently The Cyber AB, and Level 3 assessments are performed by DCMA DIBCAC, according to 32 CFR 170.17 and 170.18. Self-assessments at Level 2 are conducted against NIST SP 800-171A, and you submit the results through the official process. When you select a partner, confirm in writing which deliverables are configuration, documentation and test evidence, and which activities belong to an independent assessor.