We're evaluating replacements for VMware in secure, classified areas that require accreditation. The main candidates so far are Hyper-V and Proxmox. The underlying hosts will need to be hardened and STIG-compliant, and having reliable automated compliance scanning is important because we want to avoid a largely manual assessment process. Hyper-V currently seems like the easier path because Windows Server has established DISA STIG guidance and our Authorizing Official is already familiar with it. Proxmox is appealing from a cost and flexibility standpoint, but it does not appear to have a dedicated checklist, so we would likely need to map controls manually and justify the platform during authorization. What platforms are others using, and how have the accreditation, support, migration, and operational considerations worked out?
4 Answers
Proxmox can absolutely do the virtualization job, and organizations are running hundreds of VMs on it successfully. The backup product is especially well regarded, and the licensing cost is attractive. The tradeoff in a classified environment is the accreditation effort: you may need to harden the Debian base yourself, account for the management interface separately, document compensating controls, and build a tailored checklist for the AO. If your team is comfortable with Linux hardening and your AO accepts that approach, it can work, but it is not necessarily the path of least resistance.
XCP-ng with Xen Orchestra is another option, and Azure Local has also worked for teams leaving VMware. These may be worth evaluating if you already have the required vendor relationships and support model. Still, for a conventional on-prem classified deployment, the biggest deciding factor may be the accreditation authority rather than raw hypervisor features. Ask the AO which platforms and baselines they are willing to accept before investing heavily in a proof of concept.
Exactly. A technically capable platform can become a bad project if every control has to be interpreted from scratch and the reviewers are unfamiliar with it.
It may be worth looking at platforms with an existing STIG or stronger vendor accreditation story. Nutanix and some Red Hat virtualization options were mentioned as alternatives, and a RHEL-based KVM stack could provide more flexibility than Hyper-V while still giving you a RHEL STIG to work from. Whether that is practical depends on your licensing, Linux expertise, support requirements, and what your AO will approve.
I would confirm the exact product version and scope of the available STIG before assuming it covers the entire management plane. A checklist for the host OS does not automatically cover every appliance or administrative component.
Hyper-V is probably the least risky choice for this specific accreditation scenario. The technology is mature, it is familiar to most Windows teams, and the Windows Server STIG gives you a published checklist that your AO can evaluate. Several people have moved production VMware workloads to Hyper-V using Veeam Instant Recovery, StarWind, or Microsoft’s VM conversion tools, and the migrations generally went smoothly. It may require more planning for failover clustering, domain services, witnesses, and patching, but it is a well-understood path.
That is the main reason we chose it too. The platform itself was only part of the decision; having recognizable hardening guidance made the authorization package much easier to defend.
That was our experience. Proxmox was functional and affordable, but we lost some of the mature VMware integration and reporting, and several tasks required scripts or custom tooling.