How to read this site
“What it is” is based on the slide and Fortinet’s published material. “Why this matters in corrections” and “CJIS alignment” are an independent interpretation for corrections. They don’t mean Fortinet or the FBI makes these claims, and they aren’t proof of how a product performs in your facility.
CJIS
Mappings on this site use FBI CJIS Security Policy v6.1, dated June 25, 2026. Control names and priorities come from that document.
Scope comes first. The policy applies wherever criminal justice information (CJI) is stored, processed or transmitted. Separating CJI systems from everything else is one of the most useful things a firewall can do, because it limits how much of your environment falls within CJIS scope. Your state decides what’s in scope.
No product makes you compliant. The agency is responsible for compliance, and a product can only support a control. Policy, training, screening, physical security and documentation still have to be in place.
Priority column. Under the policy, Priority 1 requirements and requirements carried over from before version 5.9 are sanctionable now. An asterisk (P2*) marks a carried-over control. Other Priority 2 to 4 requirements are in zero-cycle status through September 30, 2027. Your state may set its own timeline.
Numbers worth knowing. AC-7 sets a limit of 5 invalid logon attempts in 15 minutes, with administrator release, and AC-11 requires a device lock after at most 30 minutes of inactivity (from the policy). California DOJ’s July 2026 bulletin reports monthly vulnerability scanning under RA-5, training within 30 days of an incident under AT-2, and FIPS 140-3 modules for CJI outside physically secure locations. Audit records must be kept for at least one year under AU-11, according to a third-party guide to v6.1. I couldn’t read the policy’s text for these last controls directly, or confirm the minimum key strength, which sources report differently. Check them in the policy.
FIPS. Fortinet’s FIPS page lists 140-3 validations for FortiGate 7.2/7.4, FortiClient, FortiSwitch 7.6 and FortiAP 7.4, tied to specific builds and models. Other products appear with 140-2 entries only. Verify your exact model and firmware in NIST’s CMVP database.
Cloud services and outside staff. Anything that could expose unencrypted CJI to a provider raises questions of data location, personnel screening and contract language, including the CJIS Security Addendum. Ask your CJIS Systems Officer early.
Click tracking
This site records page views and clicks, including the page, what was clicked, approximate location, device type and a random visitor ID. It doesn’t store IP addresses or names.
Inmate technology
Know who runs the network. Many inmate tablet, messaging and phone programs run on a vendor’s own network. Fortinet can enforce these controls only on networks and devices the agency controls, so confirm what your vendor’s contract and design allow.
What logs can and can’t show. Logs can show what happened, when, on which device and how. Tying that to one inmate requires individual logins, and shared devices need other records, such as video or assignment logs. The reason why comes from staff and investigators.
Legal limits. Have counsel review any monitoring. Attorney-client communications, religious materials and other protected activity may need to be excluded from inspection or logging. Decrypting traffic also requires a certificate on each managed device.
Real-world examples
- When a county was hit, the jail felt it. In January 2022, ransomware aimed at Bernalillo County, New Mexico, took down most data systems at its Metropolitan Detention Center, cut camera access and briefly disabled automatic doors. Inmates were confined to cells and visits were suspended. Malwarebytes
- A phishing attack on a Michigan jail. In 2017, a man used phishing emails and phone calls on Washtenaw County employees to get into the county network, then altered a jail record to try to win an inmate’s early release. Staff caught it, and the county’s losses were at least $235,488. U.S. Department of Justice
- Cameras are computers too. In March 2021, hackers compromised Verkada security cameras, including cameras inside jails and prisons. Correctional News
- The closet counts. Correctional News points to unlocked switches, active unused ports and unknown devices as physical ways onto a facility network. Correctional News
- Doors run on computers. Correctional News warns that the programmable controllers (PLCs) used for door control have no antivirus protection, and recommends isolating them or tightly firewalling them. Correctional News
Solutions without a standalone data sheet
I couldn’t find a public data sheet for these. Each page links to the closest Fortinet document instead.
Change from the slide
The slide gives FortiAuthenticator Cloud the same description as FortiHSM (“Crypto key management, storage and encryption services”). This site uses a description based on Fortinet’s FortiAuthenticator Cloud data sheet instead.