Yes, and we will work through your process, not ours
Most public-sector pages explain why a product is good. This one explains how the purchase actually happens, because in government IT the acquisition route is usually harder than the technical decision.
Two numbers decide your route
Both were raised effective 1 October 2025, and both are higher than most people remember. A single-site firewall refresh often falls under the first; a multi-site rollout often still falls under the second.
$15,000
Raised from $10,000 effective 1 October 2025. Purchases at or below it can generally be made on a government purchase card without competition.
GSA SmartPay bulletin →$350,000
Raised from $250,000 effective 1 October 2025. Below it, agencies use simplified procedures rather than full-and-open competition.
FAR 2.101 threshold update →Tell us your vehicle
We do not list contract vehicles on this site that we do not hold. In a procurement context that is not marketing licence; it is a misrepresentation a contracting officer is entitled to rely on, and you would be right to walk away from a supplier who did it.
So: tell us the vehicle you are bound by and we will tell you plainly whether we can transact on it or whether it routes through a holder we work alongside. Either way you get the same sizing, configuration and deployment work, the vehicle decides who invoices you, not who does the engineering.
Where you sit changes the answer
Selling Fortinet to Federal Agencies
How federal purchases of network security actually get made, and where we fit
Read →State, Local Government & Education
Cooperative contracts, CJIS-bound networks, and school districts under E-Rate
Read →Compliance Frameworks and What They Mean for a Firewall
CMMC, CJIS, FISMA and StateRAMP, translated into configuration
Read →The programmes, and where to verify them
Every one of these is specific to a product model and a firmware version, and every one of them changes. We link the authoritative source for each rather than reproducing a snapshot that will quietly go stale, and we confirm the current position for the exact parts on your quote before you order.
FIPS 140-2 / 140-3
NIST cryptographic module validation. Validation is specific to a FortiOS version and a hardware model, and Fortinet documents some versions as in progress rather than complete, always confirm the exact firmware you intend to run.
Verify at the source →Common Criteria / NIAP
ISO/IEC 15408, operated by 17 certificate-authorising nations and recognised by 31. Certification applies to named product versions against a specific Protection Profile.
Verify at the source →DoDIN APL
The Department of Defense Information Network Approved Products List, the consolidated list of products approved for DoD networks. Listings are per model and per version and change over time; check the current list for the exact model you are specifying.
Verify at the source →NSA CSfC
Commercial Solutions for Classified, the programme allowing layered commercial products to protect classified information in place of purpose-built government cryptography.
Verify at the source →USGv6 / IPv6
US Government IPv6 profile conformance, tested through the University of New Hampshire InterOperability Laboratory.
Verify at the source →Section 508 / VPAT
Accessibility conformance under the Rehabilitation Act, documented per product in a Voluntary Product Accessibility Template.
Verify at the source →TAA compliance
Trade Agreements Act, goods must be manufactured or substantially transformed in the US or a designated country. Required by GSA Schedule and SEWP among others, and the compliance question most likely to disqualify hardware late in a purchase.
Verify at the source →ISO 27001 · SOC 2
Information security management and service-organisation controls covering Fortinet's own operations, frequently requested as supplier assurance evidence.
Verify at the source →What buyers ask us first
Can you sell to government agencies?
Yes, and the honest answer has two parts. Below the simplified acquisition threshold, which as of October 2025 is $350,000, agencies have wide latitude in who they buy from, and a great deal of network security equipment falls under it. Above that line, or where an agency requires a specific contract vehicle, the purchase routes through the holder of that vehicle and we work alongside them on the technical side. We will tell you which situation you are in early rather than at the end of a procurement cycle.
Will you work with our procurement process?
That is the point of this section. Tell us the process you are bound by, the vehicle, the thresholds, the fiscal year end, the forms your contracting officer needs, and we will work to it. We would rather adapt to your process than ask you to adapt to ours, because your process is not negotiable and ours is.
What documentation will you provide?
Line-item quotes with manufacturer part numbers, the manufacturer's compliance documentation for the specific parts quoted, a written statement of what is and is not included, and confirmation in writing of any compliance representation you need before you order. If your contracting officer needs something in a particular format, ask; that is usually easy.
Do you hold a GSA Schedule or SEWP contract?
Ask us and you will get a straight answer. We deliberately do not list contract vehicles on this site that we do not hold: in a procurement context that is not marketing licence, it is a misrepresentation a contracting officer is entitled to rely on. Where a vehicle we do not hold is required, that is a routing question rather than an obstacle.
Is Fortinet certified for government use?
Fortinet participates in the programmes that matter, FIPS 140-2/140-3, Common Criteria/NIAP, the DoDIN APL, NSA CSfC, USGv6, Section 508 and TAA. The important caveat is that these are specific to product models and firmware versions and they change. We confirm the current position for the exact parts on your quote rather than pointing at a general claim.