VIAVI Solutions Inc. (Nasdaq: VIAV) has completed Cybersecurity Maturity Model Certification Level 2 for its aerospace-and-defense radio test, avionics, synthetic and modular, and resilient position, navigation and timing product lines. The compliance milestone gives the test-and-measurement supplier a defined credential for work involving Department of Defense customers and controlled information, rather than introducing a new product or disclosing a contract award.
The certification matters because DoD’s CMMC program is intended to establish whether contractors can protect Federal Contract Information and Controlled Unclassified Information on their systems and networks. For agencies and prime contractors, that protection affects the vendors that can participate in technology supply chains where technical data, mission requirements or other sensitive material must move between government and industry. A supplier’s compliance posture can become an acquisition issue before a program office evaluates the equipment itself, particularly when designs, test results or system interfaces need to be shared with an outside vendor.
VIAVI said A-LIGN, a certified third-party assessment organization, conducted the assessment. The company said the certification covers the named product lines in its Aerospace and Defense division; it did not say that every VIAVI business, product or acquired operation is covered. It said it plans to extend the certification to Inertial Labs product lines acquired in 2025. That makes the stated boundary relevant for buyers that might deal with more than one VIAVI business unit or product family.
VIAVI develops test, monitoring, assurance and resilient PNT technologies used in communications networks, data centers, aerospace and first-responder environments. In the defense context, those tools can support the testing and maintenance of radio, avionics and positioning systems. CMMC does not independently validate a product’s performance, security features or suitability for a particular mission. It addresses the company’s cybersecurity practices for the covered work.
That distinction is important for government buyers. A CMMC Level 2 credential can be a necessary procurement and supply-chain qualification when a program involves covered information, but it does not replace technical evaluation, interoperability testing, authorization decisions or the security requirements attached to a specific contract. The company did not disclose its assessment scope in more detail, a certification expiration date, pricing or any customer deployments associated with the milestone.
One potential application would be a defense program office or prime contractor sourcing test equipment for a communications or navigation program that requires the supplier to receive controlled technical data. VIAVI’s certification could make it easier to assess whether the covered business unit meets a cybersecurity prerequisite for that work. Agencies would still need to confirm that the particular product line, contract scope and information flows fall within the certification’s boundaries.
The near-term value is largely operational: suppliers that can demonstrate compliance may face fewer barriers as CMMC requirements move into defense acquisitions. For VIAVI, the certification strengthens a position in a market where radio, avionics and PNT vendors increasingly have to prove both engineering capability and information-security discipline. Its practical impact will depend on the scope of future solicitations, the company’s ability to extend coverage where needed and whether its products meet the technical and acquisition requirements of individual programs.