The VMM must maintain a separate execution domain for each guest VM.

VMMs can maintain separate execution domains for each executing guest VM by assigning each guest VM a separate address space. Each VMM guest VM has a distinct address space so that communication between guest VMs is performed in a manner controlled through the security functions of the VMM, and one guest VM cannot modify the executing code of another guest VM. This capability is available in most commercial VMMs that employ virtualization processor technologies.

This requirement also applies to Zero Trust initiatives.

Verify the VMM maintains a separate execution domain for each guest VM.

If it does not, this is a finding.

Configure the VMM to maintain a separate execution domain for each guest VM.