I am just looking for advice or any verification the thinking is correct here

We have a virtual machine hosted at azure gov and use gcch on the machine as we have both itar and cui data. The users are taking cui pdfs from their emails, changing them, sending them back out through exchange on gcch

We have had a new request to install adobe acrobat on the virtual machine. We have held up the request as we believe that any services attached to adobe acrobat would have to be fedramp moderate or above in order for it to be installed on the virtual machine

Just looking for verification that the line of thinking makes sense as my department lead didn’t want to hold up work for no reason. Also didn’t want to spend money if installing adobe acrobat standard is fine