FortiClient is the security app on each computer. EMS is the console IT uses to manage all those apps in one place.
The agent provides VPN, ZTNA, web filtering, malware protection and vulnerability checks. EMS (Endpoint Management Server) deploys profiles, shows status and shares device information with FortiGate.
This gives control over the device itself. On agency-managed Windows or Mac computers, such as law library or classroom PCs, EMS can restrict what the machine can do, even if network rules are bypassed.
- Blocks USB storage on inmate-use computers.
- Applies web rules directly on the device.
- Shows which devices are out of date or noncompliant.
- Removable media control: USB storage can be blocked on managed PCs, which closes one way to move files between inmates.
- Central deployment and profiles.
- Vulnerability reporting by endpoint.
- Device tags feed firewall policy, so a risky machine can be restricted.
- Fortinet lists FIPS 140-3 validation for FortiClient crypto, tied to specific versions.
| Control | Priority | How this helps |
|---|---|---|
| RA-5Vulnerability Monitoring and Scanning | P1 | Reports endpoint vulnerabilities, which supports scanning. |
| SI-2Flaw Remediation | P1 | Shows missing patches. |
| AC-17Remote Access | P1 | Provides VPN or ZTNA for remote access. |
| SI-3Malicious Code Protection | P1 | Provides endpoint malware protection. |
| CM-8System Component Inventory | P1 | Lists managed endpoints. |
Based on CJIS Security Policy v6.1. This product can support these controls but can’t satisfy them alone. How to read this table