A controlled gateway for web browsing. It checks internet traffic for threats and enforces what can be reached.
Browsers or networks send web requests through the proxy, which decrypts where permitted, filters by category and identity, scans for malware, and logs activity. It can run as hardware or a virtual machine.
This is where administrators get detail about what an inmate is viewing. In a program with approved web access, staff may want the specific pages, searches and times, and need control down to a website or category.
- Allows only approved education and reentry sites.
- Records specific pages visited, with time and user.
- Applies different rules for inmate programs, staff groups and contractors.
- Allowlist mode: inmate devices reach only named sites.
- User-based logs: web activity is tied to a user account where inmates sign in individually.
- Per-group policy using directory integration.
- Allowlist operation for education or reentry devices.
- Decryption with inspection exclusions, for example banking or health sites.
- Detailed logs for investigations.
| Control | Priority | How this helps |
|---|---|---|
| SI-3Malicious Code Protection | P1 | Scans web traffic for malware. |
| SC-7Boundary Protection | P1 | Mediates outbound web access at the boundary. |
| AU-2Event Logging | P2* | Logs web activity. |
| AC-4Information Flow Enforcement | P1* | Controls what web traffic can flow. |
Fortinet’s FIPS page shows a 140-2 entry for FortiProxy. Confirm the current status if it handles CJI traffic.
Based on CJIS Security Policy v6.1. This product can support these controls but can’t satisfy them alone. How to read this table